apt

Homeland Justice

active · last signal 6mo agoAttribution: HighWell-corroborated — multiple independent sources or primary reporting.

APT / State-sponsored

HomeLand Justice

Attribution

Online persona, not an independent intrusion set. Operated by Void Manticore (Iran, MOIS-affiliated) - High confidence: Check Point Research says Void Manticore operates Homeland Justice 'for attacks in Albania' and describes it as 'a persona the group continues to use in operations targeting Albania'; MITRE ATT&CK lists it under VOID MANTICORE (G1055) and as campaign C0038; Microsoft found that DEV-0842 (now Storm-0842, i.e. Void Manticore) 'deployed the ransomware and wiper malware' in the July 2022 attack the persona claimed; and the US DOJ describes Justicehomeland[.]org as an official website of 'a shell hacktivist entity used by MOIS'. Initial access for that attack came from a separate cluster that Microsoft links, at moderate confidence, to EUROPIUM. Claims published under the persona are the operator's own assertions unless independently corroborated.

Origin

Iran (operator assessed)

First seen

2022 (website and social media profiles created in June 2022, per CISA/FBI)

Last active

2026 (claimed intrusion into the Albanian parliament's email, March 2026 - self-claim; Albanian authorities had not publicly attributed it)

Motivation

Destructive and psychological operations against Albania - wiper attacks and hack-and-leak, with anti-MEK messaging (CISA/FBI)

Attribution confidence

high

Sectors

Government

Why it mattersState-sponsored / APT actor, high confidence (Government sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified TargetsreportORKL2026-03-20
Mandiant M-Trends 2025 ReportreportORKL2025-04-24
Inside BlackBasta: Actor Profiles, Extortion Tactics & FinancesreportORKL2025-04-02
Israel-Hamas War in Cyber February 2024 Tool of First ResortreportORKL2024-02-08
NoJustice WiperreportORKL2024-01-04
2023 State of The Threat – A Year in ReviewreportORKL2023-09-29
Multi-year Chinese APT Campaign Targets South Korean Academic, Government, and Political EntitiesreportORKL2023-09-19

Overview

Homeland Justice is a public-facing 'hacktivist' persona that Check Point Research, MITRE ATT&CK and the US DOJ tie to Iran's Ministry of Intelligence and Security, and that Check Point attributes to Void Manticore. It is used to claim and publicise destructive attacks on the Albanian government. Its targeting in the sources reviewed is Albania only - no Middle East or North Africa country - and it is tracked here because its operator is a MENA-focused actor.

History

In June 2022 the persona created a website and social media profiles posting anti-MEK messages (CISA/FBI AA22-264A). On 18 July 2022 it claimed credit for a destructive attack on Albanian government infrastructure in which ROADSWEEP ransomware and a version of the ZeroCleare wiper were deployed; Microsoft attributes the ransomware and wiper deployment to DEV-0842 (Void Manticore) and the initial access to a separate cluster it links to EUROPIUM, matching Check Point's hand-off model in which Scarred Manticore obtains access and Void Manticore runs the destructive phase. A second wave hit the Albanian government in September 2022. The persona resurfaced on 24 December 2023, when researchers documented a wiper they call No-Justice, and in March 2026 it claimed an intrusion into the Albanian parliament's email that authorities had not publicly attributed. On 19 March 2026 the US DOJ seized Justicehomeland[.]org.

Notable campaigns

2022

Albanian government destructive attack

ROADSWEEP ransomware and a ZeroCleare-variant wiper deployed against Albanian government networks; the persona claimed credit on 18 July 2022. CISA/FBI AA22-264A; Microsoft attributes the ransomware and wiper deployment to DEV-0842 (Void Manticore); tracked by MITRE ATT&CK as campaign C0038.

2022

Second wave (September)

In September 2022 Iranian actors launched another wave of attacks on the Government of Albania using similar TTPs and malware (CISA/FBI AA22-264A); the DOJ says the persona's domain was used to claim the theft of Albanian government documents on or about 15 July and 9 September 2022.

2023

Resurgence and No-Justice wiper

The persona resurfaced on 24 December 2023 after a hiatus; researchers documented a wiper they call No-Justice in attacks on Albanian institutions. Check Point separately observed Void Manticore dropping partition wipers in Albania similar to the BiBi wipers used in Israel.

Useful?