ZeroCleare
Software · ATTACK:enterprise:S1151
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1151",
"title": "ZeroCleare",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1151",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--8d8518db-0f52-4f3c-8017-01389a8522bb",
"external_id": "S1151",
"domain": "enterprise",
"created": "2024-08-08T19:52:06.393Z",
"modified": "2024-09-04T19:16:36.655Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ZEROCLEAR"
},
{
"source_name": "CISA Iran Albanian Attacks September 2022",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"
},
{
"source_name": "Mandiant ROADSWEEP August 2022",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
},
{
"source_name": "IBM ZeroCleare Wiper December 2019",
"url": "https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"
},
{
"source_name": "Microsoft Albanian Government Attacks September 2022",
"url": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--029f82d6-72d9-43ac-a480-ae5169d20135
Mandiant ROADSWEEP August 2022ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d61c23b-df1a-4d90-affa-b37a55b5e941
IBM ZeroCleare Wiper December 2019ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:S1151
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4454f45e-8dda-4914-9689-83ade769523d
CISA Iran Albanian Attacks September 2022 · Microsoft Albanian Government Attacks September 2022ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S1151
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45159cd3-3e77-433b-a9ea-388875655103
IBM ZeroCleare Wiper December 2019ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5baffc71-6b6f-4a8c-ae95-1aa003e6c73f
IBM ZeroCleare Wiper December 2019ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65684059-3a14-431f-8380-9b940b9a1fc1
Mandiant ROADSWEEP August 2022ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6feff8fd-f787-4afd-9503-93598e22f02b
Mandiant ROADSWEEP August 2022ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d6021ae-3dd7-45f6-ad96-96eae77fe67c
CISA Iran Albanian Attacks September 2022 · Mandiant ROADSWEEP August 2022ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9eedce39-c414-4953-9402-f80b725d003c
IBM ZeroCleare Wiper December 2019ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1561.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f419f8fb-8a3c-423d-8d01-20e99eb63693
CISA Iran Albanian Attacks September 2022 · Mandiant ROADSWEEP August 2022 · IBM ZeroCleare Wiper December 2019