Threadlinqs IntelligenceStart free

Threat actorIranTracked since 2026-03

Homeland Justice

As of 2026-10-17, Homeland Justice is a Iran-nexus threat actor tracked by Threadlinqs Intelligence across 6 threats spanning malware, threat intel, apt. ATT&CK coverage spans 88 techniques across 15 tactics in 6 of 6 tracked threats. Most-observed techniques: T1059 (Command and Scripting Interpreter), T1485 (Data Destruction), T1561 (Disk Wipe).

Tracked threats
64 critical · 1 high · 1 medium
First seen
2026-03-12
Last seen
2026-10-17
ATT&CK techniques
88across 6 of 6 threats
Related CVEs
0None referenced
Attribution
IranNation or origin
Nation: Iran · 6 tracked threat(s) · Categories: MALWARE, THREAT_INTEL, APT

Activity timeline

Homeland Justice appears in 6 tracked threats between and ; the busiest month was 2026-03 with 4 reports.

ATT&CK techniques observed

88 techniques observed across 6 of 6 tracked threats · Impact (13), Command and Control (9), Discovery (8), Execution (8), Stealth (formerly Defense Evasion) (7), Persistence (6)
  • T1059 Command and Scripting Interpreter — Executionobserved in 5 of 6 tracked threats
  • T1485 Data Destruction — Impactobserved in 5 of 6 tracked threats
  • T1561 Disk Wipe — Impactobserved in 5 of 6 tracked threats
  • T1003 OS Credential Dumping — Credential Accessobserved in 4 of 6 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 4 of 6 tracked threats
  • T1053 Scheduled Task/Job — Executionobserved in 4 of 6 tracked threats
  • T1087 Account Discovery — Discoveryobserved in 4 of 6 tracked threats
  • T1133 External Remote Services — Initial Accessobserved in 4 of 6 tracked threats
  • T1486 Data Encrypted for Impact — Impactobserved in 4 of 6 tracked threats
  • T1572 Protocol Tunneling — Command and Controlobserved in 4 of 6 tracked threats
  • T1005 Data from Local System — Collectionobserved in 3 of 6 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 3 of 6 tracked threats
  • T1037 Boot or Logon Initialization Scripts — Persistenceobserved in 3 of 6 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 3 of 6 tracked threats
  • T1047 Windows Management Instrumentation — Executionobserved in 3 of 6 tracked threats

Tracked threats