# Homeland Justice (Iran-linked) "No-Justice" wiper (NACL.exe) targeting Albanian organizations

> ClearSky reports that the Iranian psychological-operation group "Homeland Justice" used a Windows wiper dubbed "No-Justice" (NACL.exe), pushed by a WinRM-based PowerShell script (p.ps1), against the Albanian Parliament, ONE Albania, Eagle Mobile and Air Albania in late December 2023. ClearSky assesses the wiping campaign may threaten other countries.

- **Published:** 2026-10-17T15:44:14Z
- **Last reviewed:** 2026-10-17T15:44:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3819
- **ID:** TL-2026-3819
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Homeland Justice (Iran)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2023-12-24 the Iranian-aligned persona Homeland Justice resurfaced after a hiatus under the hashtag #DestroyDurresMilitaryCamp (a reference to the MEK presence in Durres, Albania). It posted a video showing segments of PowerShell code used against the Albanian Parliament. ClearSky located a PowerShell file that matched the displayed code, including a reference to a file named NACL.exe, and dubbed the executable the "No-Justice Wiper". The attack against the Parliament and a telecommunications company occurred on 2023-12-25. Victims named in public reporting are the Albanian Parliament, ONE Albania, Eagle Mobile and Air Albania. ClearSky said the actor's data-destruction efforts were ultimately unsuccessful, and the actor also claimed unconfirmed data theft.

NACL.exe is a Windows binary of about 220 KB that requires administrator privileges. It loads a library, resolves API function addresses, builds the path \\.\c: , opens the disk with CreateFileW and calls DeviceIoControl with control code 0x7c100 (IOCTL_DISK_DELETE_DRIVE_LAYOUT), which removes the partition/drive layout so the system crashes and cannot be rebooted (ClearSky describes it as removing the MBR boot signature). The sample carried a valid digital signature issued to "Attest Inspection Limited"; a prior Homeland Justice wiper used a signature attributed to Kuwait Telecommunications Company KSC, suggesting a repeated practice of signing destructive tooling. The binary was compiled under the internal name Ptable.exe according to independent analysis.

Deployment used a PowerShell script (p.ps1) run from a domain controller with administrative privileges. It tests machine reachability, enumerates and remotely enables WinRM via Invoke-WmiMethod, opens PSSessions, copies the wiper with Copy-Item, and executes it in parallel with Invoke-Command. ClearSky also observed legitimate or dual-use tooling for reconnaissance, lateral movement and persistent remote access: Plink (PuTTY Link), RevSocks (reverse SOCKS proxy) and utilities from the Windows 2000 Resource Kit (local admin enumeration). Earlier Homeland Justice operations (2022) used SharePoint CVE-2019-0604 for initial access, web shells, ROADSWEEP/GoXML.exe encryption and ZeroCleare-style disk wiping with the RawDisk driver (MITRE campaign C0038; CISA AA22-264A). Earlier waves in July and September 2023 reportedly hit Albanian e-government systems and police systems. ClearSky's PDF could not be parsed in this research run; details are taken from secondary coverage of it and should be re-verified against the PDF. No network IOCs (IPs/domains) were published in any source.

Note on a hash discrepancy: The Hacker News and GovInfoSecurity attribute SHA-256 36cc72c5...531f to the wiper and c8b72d64...4ac8 to p.ps1, while the 0x09AL blog states the reverse. Both values are recorded with that caveat.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1021.006 Windows Remote Management
- T1570 Lateral Tool Transfer
- T1078.002 Domain Accounts
- T1553.002 Code Signing
- T1018 Remote System Discovery
- T1069.001 Local Groups
- T1090 Proxy
- T1572 Protocol Tunneling
- T1561 Disk Wipe
- T1561.002 Disk Wipe: Disk Structure Wipe

## Sources

- [ClearSky: No-Justice Wiper (PDF)](https://www.clearskysec.com/wp-content/uploads/2024/01/No-Justice-Wiper.pdf)
- [ClearSky: "Homeland Justice" targets Albanian organizations with "No-justice" wiper](https://www.clearskysec.com/no-justice-wiper/)
- [0x09AL Security blog: Analysis of the malware used in the recent attacks targeting Albania](https://blog.pwn.al/albania/apt/state/actor/hacking/cyberattack/homelandjustice/2023/12/28/An-analysis-of-the-malware-used-in-the-recent-attacks-targeting-Albania.html)
- [The Hacker News: Pro-Iranian Hacker Group Targeting Albania with No-Justice Wiper Malware](https://thehackernews.com/2024/01/pro-iranian-hacker-group-targeting.html)
- [GovInfoSecurity: Iranian APT Used No-Justice Wiper in Recent Albanian Attacks](https://www.govinfosecurity.com/iranian-apt-used-no-justice-wiper-in-recent-albanian-attacks-a-24042)
- [The Record: Wiper malware found in analysis of Iran-linked attacks on Albanian institutions](https://therecord.media/albania-parliament-telecoms-airline-cyberattacks-wiper-malware)
- [MITRE ATT&CK: HomeLand Justice (C0038)](https://attack.mitre.org/campaigns/C0038/)
- [CISA/FBI AA22-264A: Iranian State Actors Conduct Cyber Operations Against the Government of Albania](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3819