CISA Iran Albanian Attacks September 2022

During HomeLand Justice, threat actors dumped LSASS memory on compromised hosts.

During HomeLand Justice, threat actors primarily used RDP for lateral movement in the victim environment.

During HomeLand Justice, threat actors used SMB for lateral movement.

The ROADSWEEP binary contains RC4 encrypted embedded scripts.

During HomeLand Justice, threat actors renamed ROADSWEEP to GoXML.exe and ZeroCleare to cl.exe.

During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.

During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.

During HomeLand Justice, threat actors used PowerShell cmdlets New-MailboxSearch and Get-Recipient for discovery.

During HomeLand Justice, threat actors used Windows batch files for persistence and execution.

ZeroCleare has the ability to uninstall the RawDisk driver and delete the `rwdsk` file on disk.

During HomeLand Justice, threat actors used a compromised Exchange account to search mailboxes and create new Exchange accounts.

ROADSWEEP can enumerate files on infected devices and avoid encrypting files with .exe, .dll, .sys, .lnk, or . lck extensions.

During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts.

During HomeLand Justice, threat actors made multiple HTTP POST requests to the Exchange servers of the victim organization to transfer data.

ROADSWEEP can decrypt embedded scripts prior to execution.

For HomeLand Justice, threat actors exploited CVE-2019-0604 in Microsoft SharePoint for initial access.

ROADSWEEP requires four command line arguments to execute correctly, otherwise it will produce a message box and halt execution.

During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.

ROADSWEEP can RC4 encrypt content in blocks on targeted systems.

ROADSWEEP has the ability to disable `SystemRestore` and Volume Shadow Copies.

For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.

ROADSWEEP has been digitally signed with a certificate issued to the Kuwait Telecommunications Company KSC.

ZeroCleare can corrupt the file system and wipe the system drive on targeted hosts.

During HomeLand Justice, threat actors used a version of ZeroCleare to wipe disk drives on targeted hosts.

During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.

During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.

During HomeLand Justice, threat actors used tools with legitimate code signing certificates.