The Iranian group HomeLand Justice is behind the cyberattack in Albania in July, while the initial breach was 14 months earlier.
The Federal Bureau of Investigation (FBI) and CISA said that one of the Iranian threat groups, while hiding in the Albanian government's systems for 14 months, was behind the devastating attack on its network in July.
"An FBI investigation indicates that Iranian state threat actors gained initial access to the victim's network approximately 14 months before the devastating cyberattack, which included ransomware-style file encryption and disk wiping malware," the two agencies revealed in a joint advisory published today.
" Iranian threat actors maintained continuous access to the network for approximately a year, periodically gaining access and infiltrating email content."
See also: Malwarebytes blocks Google and YouTube for malware
The malicious actors behind the attack, collectively identified by the FBI as an Iranian-backed threat group called “HomeLand Justice,” attacked the government of Albania in July 2022, 14 months after the initial breach, taking down multiple websites and services.
This month, Iranian state hackers targeted the government of Albania in a new series of cyberattacks, using tactics and methods similar to those of the July attack.
The joint advisory provides additional technical details about HomeLand Justice within the Albanian government network, including the use of a compromised Microsoft Exchange to find and infiltrate credentials and large amounts of data.
After the July attack, Albanian Prime Minister Edi Rama said that all Iranian Embassy staff were asked to leave the country within 24 hours.
This decision comes after Albania announced that it has broken diplomatic relations with Iran after attributing the July attack to Iranian state hackers.
The US government also blamed Iran for the attack on Albania in July and said the country would be held accountable for threatening the security of a NATO.
See also: Domain shadowing is becoming very popular among hackers
The group HomeLand Justice claimed responsibility for the attack on July 18 , and from late July to mid-August, it leaked information stolen from the Albanian government network.
"These were likely carried out in retaliation for the public disclosure of cyberattacks in July and the severance of diplomatic relations between Albania and Iran," the two agencies added today.
In July 2021, US President Biden warned that cyberattacks leading to serious security breaches could also lead to a “real shooting war.”
Biden's statements came a month after NATO's statement from mid-June 2021 saying that cyberattacks may amount to "armed attacks" in some cases.
Source: bleepingcomputer.com
