HomeLand Justice Cyberattack on Albania

In July 2022, Iran-linked state cyber actors operating under the name 'HomeLand Justice' launched a destructive large-scale cyberattack against Albanian government digital infrastructure, rendering government websites and public-facing services unavailable and destroying government data. The attack involved a combination of ransomware, wiper malware, and data exfiltration.

A joint advisory issued on 21 September 2022 by the United States Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) attributed the attack to Iranian state actors affiliated with the IRGC Intelligence Organisation, who had first gained access to Albanian government networks in approximately May 2021 — more than 14 months before launching the destructive payload. The advisory noted the unusually long dwell time suggested deliberate, patient pre-positioning.

The attributed motivation was retaliation against Albania for hosting the Mojahedin-e Khalq (MEK) at Camp Ashraf-3. On 6 September 2022, Albanian Prime Minister Edi Rama announced the attack's attribution to Iran and declared Albania was severing all diplomatic relations with the Islamic Republic — the first known instance of a country cutting diplomatic ties specifically over a cyberattack — expelling all Iranian embassy staff within 24 hours. This event is recorded separately as the Albania severs diplomatic relations with Iran event.