Threat reportMalwareTL-2026-3819
Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe) targeting Albanian organizations
Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe) (TL-2026-3819), also tracked as No-Justice Wiper, is a high-severity malware campaign, first published 2026-10-17. It is attributed to Homeland Justice (Iran) with medium confidence, affects Microsoft Windows, maps to 12 MITRE ATT&CK techniques (T1018, T1021.006, T1047), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 1Homeland Justice
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-3819
- Threat ID
- TL-2026-3819
- Also known as
- No-Justice Wiper, NACL.exe, #DestroyDurresMilitaryCamp
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Homeland Justice
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Iran
- Motivation
- DESTRUCTION
- Target sectors
- government administration, telecoms, aviation
- Target regions
- albania, Europe
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe)
Malware and tooling: No-Justice Wiper, ZeroCleare, Plink, RevSocks, Windows 2000 Resource Kit, ZeroCleare
How Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe) works
ClearSky reports that the Iranian psychological-operation group "Homeland Justice" used a Windows wiper dubbed "No-Justice" (NACL.exe), pushed by a WinRM-based PowerShell script (p.ps1), against the Albanian Parliament, ONE Albania, Eagle Mobile and Air Albania in late December 2023. ClearSky assesses the wiping campaign may threaten other countries.
On 2023-12-24 the Iranian-aligned persona Homeland Justice resurfaced after a hiatus under the hashtag #DestroyDurresMilitaryCamp (a reference to the MEK presence in Durres, Albania). It posted a video showing segments of PowerShell code used against the Albanian Parliament. ClearSky located a PowerShell file that matched the displayed code, including a reference to a file named NACL.exe, and dubbed the executable the "No-Justice Wiper". The attack against the Parliament and a telecommunications company occurred on 2023-12-25. Victims named in public reporting are the Albanian Parliament, ONE Albania, Eagle Mobile and Air Albania. ClearSky said the actor's data-destruction efforts were ultimately unsuccessful, and the actor also claimed unconfirmed data theft.
NACL.exe is a Windows binary of about 220 KB that requires administrator privileges. It loads a library, resolves API function addresses, builds the path \\.\c: , opens the disk with CreateFileW and calls DeviceIoControl with control code 0x7c100 (IOCTL_DISK_DELETE_DRIVE_LAYOUT), which removes the partition/drive layout so the system crashes and cannot be rebooted (ClearSky describes it as removing the MBR boot signature). The sample carried a valid digital signature issued to "Attest Inspection Limited"; a prior Homeland Justice wiper used a signature attributed to Kuwait Telecommunications Company KSC, suggesting a repeated practice of signing destructive tooling. The binary was compiled under the internal name Ptable.exe according to independent analysis.
Deployment used a PowerShell script (p.ps1) run from a domain controller with administrative privileges. It tests machine reachability, enumerates and remotely enables WinRM via Invoke-WmiMethod, opens PSSessions, copies the wiper with Copy-Item, and executes it in parallel with Invoke-Command. ClearSky also observed legitimate or dual-use tooling for reconnaissance, lateral movement and persistent remote access: Plink (PuTTY Link), RevSocks (reverse SOCKS proxy) and utilities from the Windows 2000 Resource Kit (local admin enumeration). Earlier Homeland Justice operations (2022) used SharePoint CVE-2019-0604 for initial access, web shells, ROADSWEEP/GoXML.exe encryption and ZeroCleare-style disk wiping with the RawDisk driver (MITRE campaign C0038; CISA AA22-264A). Earlier waves in July and September 2023 reportedly hit Albanian e-government systems and police systems. ClearSky's PDF could not be parsed in this research run; details are taken from secondary coverage of it and should be re-verified against the PDF. No network IOCs (IPs/domains) were published in any source.
Note on a hash discrepancy: The Hacker News and GovInfoSecurity attribute SHA-256 36cc72c5...531f to the wiper and c8b72d64...4ac8 to p.ps1, while the 0x09AL blog states the reverse. Both values are recorded with that caveat.
MITRE ATT&CK techniques used in TL-2026-3819
Discovery
T1018 Remote System Discovery; T1069.001 Local Groups
Lateral Movement
T1021.006 Windows Remote Management; T1570 Lateral Tool Transfer
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell
Privilege Escalation
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
defense-impairment
Impact
Affected products and versions in Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe)
- Microsoft — Windows
Vulnerable versions: Windows endpoints and servers reachable by WinRM with administrator access
Remediation for Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe)
Patches
- No CVE is tied to the 2023 wiper activity; for 2022-era access, apply the Microsoft SharePoint patch for CVE-2019-0604
Immediate actions
- Hunt for NACL.exe, Ptable.exe and p.ps1 and for the listed SHA-256 hashes on endpoints and file shares
- Alert on remote WinRM enablement via Invoke-WmiMethod and on mass Copy-Item/Invoke-Command from domain controllers
- Alert on plink.exe and revsocks execution and on Windows 2000 Resource Kit utilities outside admin baselines
- Alert on CreateFileW on \\.\PhysicalDrive/\\.\C: followed by DeviceIoControl 0x7c100 (IOCTL_DISK_DELETE_DRIVE_LAYOUT)
Workarounds
- Disable WinRM where not required and limit it with firewall rules
- Block outbound SOCKS/SSH tunneling to untrusted hosts
Longer-term hardening
- Maintain offline, tested backups and bare-metal recovery images for domain controllers and critical servers
- Restrict WinRM/PowerShell remoting to named admin jump hosts and tier domain admin accounts
- Enforce application allow-listing and validate code-signing publishers rather than trusting any valid signature
- Deploy EDR with behavioral detection for raw disk access and partition-table destruction
Timeline of Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe)
- Homeland Justice conducts the first destructive wave against Albanian government networks (ransomware and wiper), begins social-media campaign (July 2022)
- Second attack wave against Albania following public attribution and severing of diplomatic ties (September 2022)
- FBI and CISA publish joint advisory AA22-264A on Iranian state actors' operations against the Albanian government
- Reported 2023 campaign against Albanian e-government systems (July 2023)
- Reported attacks on Albanian national police systems, including border/airport tracking (September 2023)
- Homeland Justice resurfaces after a hiatus with the #DestroyDurresMilitaryCamp campaign and posts a video showing PowerShell code used against the Albanian Parliament
- No-Justice wiper attack against the Albanian Parliament and a telecommunications company; data destruction reportedly unsuccessful
- 0x09AL Security publishes analysis of p.ps1 and NACL.exe, including hashes and the DeviceIoControl 0x7c100 wipe behavior
- ClearSky's No-Justice Wiper report is covered by The Hacker News; ClearSky assesses the campaign may threaten other countries
- Wiper sample detected by 29 VirusTotal vendors; p.ps1 detected by 2 vendors
Sources cited for Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe)
- ClearSky: No-Justice Wiper (PDF)
- ClearSky: "Homeland Justice" targets Albanian organizations with "No-justice" wiper
- 0x09AL Security blog: Analysis of the malware used in the recent attacks targeting Albania
- The Hacker News: Pro-Iranian Hacker Group Targeting Albania with No-Justice Wiper Malware
- GovInfoSecurity: Iranian APT Used No-Justice Wiper in Recent Albanian Attacks
- The Record: Wiper malware found in analysis of Iran-linked attacks on Albanian institutions
- MITRE ATT&CK: HomeLand Justice (C0038)
- CISA/FBI AA22-264A: Iranian State Actors Conduct Cyber Operations Against the Government of Albania
Detection coverage for TL-2026-3819
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3819 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.