# Iranian state actors attack Albania with ransomware and wiper malware

Published: 2025-06-18 · Severity: elevated · Sectors: government-national
Canonical: https://vorant.io/reports/b8accb86-ce60-50e9-bc75-4a63e8f007e6/iranian-state-actors-attack-albania-with-ransomware-and-wiper-malware

> Iranian state actors conducted destructive cyber operations against the Albanian government using ransomware and disk-wiping malware following initial access 14 months prior.

In July and September 2022, Iranian state cyber actors claiming the identity "HomeLand Justice" conducted destructive cyber operations against the Government of Albania. The attackers gained initial access approximately 14 months before the attacks via exploitation of CVE-2019-0604 in an internet-facing Microsoft SharePoint instance. After establishing persistence through ASPX webshells (pickers.aspx, error4.aspx, ClientBin.aspx), the actors conducted extensive network reconnaissance, lateral movement via RDP/SMB/FTP, and email exfiltration from compromised Exchange accounts over approximately eight months, transferring 70-160 MB from client and 3-20 GB from server. In May-June 2022, the actors performed credential harvesting and advanced reconnaissance using tools including Advanced Port Scanner, Mimikatz, and LSASS dumping.

The July 2022 destructive phase deployed GoXML.exe, a ransomware-style file encryptor digitally signed with a fraudulent certificate issued to Kuwait Telecommunications Company, which encrypted files on victim systems while leaving ransom notes. Simultaneously, the actors deployed a disk wiper (cl.exe and rwdsk.sys) that performed raw disk access to wipe data. The malware used RC4 encryption with hard-coded keys and RSA key exchange. After network defenders responded, the actors posted anti-MEK propaganda and leaked stolen government data. A second wave of attacks occurred in September 2022 using similar techniques, attributed to retaliation for public attribution and diplomatic rupture.

Defenders should monitor for CVE-2019-0604 exploitation, large data transfers from Exchange servers (several GB), presence of identified webshells and malware hashes, and lateral movement patterns consistent with the TTPs observed. Patch management, zero-trust architecture, network segmentation, and phishing-resistant MFA are critical mitigations.

## Mentioned in this report

- Vulnerabilities: CVE-2019-0604 (KEV)
- Threat actors: VOID MANTICORE
- Malware: ClientBin.aspx, GoXML.exe, cl.exe, disable_defender.exe, rwdsk.sys

## Detection guidance (public sample)

### IIS Worker Process Spawning Shell or Recon Utility (SharePoint Webshell Activity)

ATT&CK: T1505.004

w3wp.exe spawning cmd/PowerShell or recon utilities, consistent with ASPX webshell use after SharePoint exploitation (CVE-2019-0604). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Shell or Recon Utility (SharePoint Webshell Activity)
id: 2a0770e5-fa7c-5a1b-b9a2-b63250a1a52c
status: experimental
description: Detects the IIS worker process (w3wp.exe) spawning command shells or
  common reconnaissance and credential utilities. This is typical of ASPX webshells
  dropped after exploiting an internet-facing SharePoint server (CVE-2019-0604), as
  in the HomeLand Justice intrusion. Generalises on the parent/child relation, not
  on webshell filenames.
tags:
- attack.persistence
- attack.t1505.004
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \nltest.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Web applications that legitimately shell out to cmd.exe for administrative tasks
- Custom SharePoint or IIS deployment or health-check scripts run from the worker
  process
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a
```

### Mimikatz Named Pipe Created

ATT&CK: T1003.001

Named pipe containing 'mimikatz' created on a Windows host, indicating Mimikatz credential-dumping activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mimikatz Named Pipe Created
id: ad648704-9ccd-52d0-babe-bf21b6028948
status: experimental
description: Detects creation of a named pipe whose name contains 'mimikatz'. The
  report describes Mimikatz being used for credential harvesting in the months before
  the destructive phase.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|contains: mimikatz
  condition: selection
falsepositives:
- Red team or penetration test exercises using unmodified Mimikatz
- Security tooling tests that name a pipe after Mimikatz
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a
```

### LSASS Memory Dump via Procdump or Comsvcs MiniDump

ATT&CK: T1003.001

Command lines that dump LSASS process memory using procdump or comsvcs.dll MiniDump. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: LSASS Memory Dump via Procdump or Comsvcs MiniDump
id: a73d63ef-de3f-5d20-88a9-0da5ec237171
status: experimental
description: Detects common LSASS memory dumping command lines (procdump targeting
  lsass, or rundll32 calling comsvcs.dll MiniDump). The actors performed LSASS dumping
  during credential harvesting in May-June 2022. The report does not state the exact
  method, so this covers the most common ones.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_comsvcs:
    CommandLine|contains|all:
    - comsvcs
    - MiniDump
  selection_procdump:
    Image|endswith:
    - \procdump.exe
    - \procdump64.exe
    CommandLine|contains: lsass
  condition: 1 of selection_*
falsepositives:
- Administrators capturing LSASS dumps for authorised crash or performance troubleshooting
- EDR or forensic tools that legitimately dump LSASS
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b8accb86-ce60-50e9-bc75-4a63e8f007e6/iranian-state-actors-attack-albania-with-ransomware-and-wiper-malware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup