It is revealed how the Iranians of "Homeland Justice" hacked the website of the Albanian parliament and several other companies

2024-01-08 21:08:57Aktualitet SHKRUAR NGA REDAKSIA VOX
It is revealed how the Iranians of "Homeland Justice" hacked the
Illustrative photo

During the wave of attacks on Albanian institutions in early December, hackers linked to Iran used "malware" to delete data that researchers call "No-Justice".

The attacks, attributed to "Homeland Justice", targeted the Albanian parliament, two local telecom companies (ONE Albania and Eagle Mobile) and Albania's air carrier (Air Albania).

The hackers claimed to have stolen data from the systems, but this claim has not yet been confirmed.

Researchers at Israel-based cybersecurity firm ClearSky identified two main tools used in the campaign: No-Justice, which can crash a targeted Windows operating system "in a way that it cannot be rebooted," and a script PowerShell designed "to copy and propagate the data wipe to other devices on the organizational network prior to its activation."

No-Justice had a valid digital signature to appear legitimate and required administrator privileges to wipe data from the victim's computer, the researchers said.

The hackers likely used publicly available tools for the attack, including a suite of network communication software services called Plink; a tool called RevSocks, used to extract data, command and control, or maintain continuous access to a compromised network; and the Windows 2000 Resource Kit, which can be used for continuous remote access and discovery.

The extent of the damage is not yet clear. Earlier in December, it was reported that during the attack on the parliament, hackers tried to interfere with the infrastructure and delete data, but were unsuccessful.

ClearSky estimates that Homeland Justice's operations may threaten other countries.

The latest attacks on Albania were a possible retaliation against the Albanian government for harboring members of the Iranian opposition group Mujahedeen-e-Khalq, or MEK, in Durres County.

According to ClearSky's report, the attack on the Albanian parliament followed the publication of an image showing members of the Albanian parliament together with Mariam Rajavi, president of the MEK.

Homeland Justice launched its first campaign against Albania last July, targeting the country's e-government systems right before the planned MEK conference. The conference was canceled after the attack.

In September, Albania reported that hackers linked to the government of Iran targeted computer systems used by the national police to track individuals entering and leaving the country. The attack prompted authorities to shut down computer control systems at border crossings and airports.

The researchers described Homeland Justice as an "Iranian psychological operations group" that is likely state-sponsored.


Video