What recent cyber threats have targeted Albanian government organizations?

In July 2022, Albanian government organizations were targeted by a ransomware family called ROADSWEEP, which dropped politically themed ransom notes. The disruptive activity affected government websites and citizen services, with a group named 'HomeLand Justice' claiming responsibility. The attacks also involved the CHIMNEYSWEEP backdoor and the ZEROCLEAR wiper, which have been linked to Iran-nexus threat actors. (Source: Original Webpage)

What is the ROADSWEEP ransomware and how was it used in the Albanian attacks?

ROADSWEEP is a ransomware family identified by Mandiant that drops ransom notes with political themes. It was used in attacks against Albanian government organizations, with evidence suggesting it was part of a campaign to disrupt government services and leak sensitive documents. (Source: Original Webpage)

What is the CHIMNEYSWEEP backdoor and what are its capabilities?

CHIMNEYSWEEP is a backdoor identified by Mandiant that uses Telegram or actor-owned infrastructure for command-and-control. It can take screenshots, list and collect files, spawn a reverse shell, and supports keylogging. It shares code with ROADSWEEP and has been used to target Farsi and Arabic speakers since at least 2012. (Source: Original Webpage)

How are CHIMNEYSWEEP and ROADSWEEP related?

CHIMNEYSWEEP and ROADSWEEP share multiple code overlaps, including identical dynamic API resolution code, an embedded RC4 key, and a custom Base64 alphabet. These similarities suggest a connection between the two malware families, likely used by the same threat actors. (Source: Original Webpage)

What is the ZEROCLEAR wiper and how was it involved in the Albanian incident?

ZEROCLEAR is a wiper malware that corrupts file systems using the RawDisk driver. An Albanian user submitted a ZEROCLEAR payload to a public malware repository one day after the government announced the disruptive activity. ZEROCLEAR has been linked to Iran-nexus threat actors and used in disruptive operations in the Middle East. (Source: Original Webpage)

How does Cymulate help organizations defend against threats like ROADSWEEP and CHIMNEYSWEEP?

Cymulate's Exposure Management Platform enables organizations to simulate real-world threats, including ransomware and backdoors like ROADSWEEP and CHIMNEYSWEEP. By running automated attack simulations and validating defenses across the full kill chain, Cymulate helps organizations identify vulnerabilities and improve their security posture. (Source: Knowledge Base)

What types of threats can Cymulate validate?

Cymulate validates threats across the full kill chain, including phishing, malware, lateral movement, data exfiltration, and zero-day exploits. The platform uses daily updated threat templates and AI-generated attack plans to ensure comprehensive coverage. (Source: Knowledge Base)

How does Cymulate's Threat Validation solution address security team challenges?

Cymulate's Threat Validation solution solves two critical problems: lack of confidence in security controls (as threats evolve faster than defenses) and security configuration drift (where changes over time create new gaps). The platform continuously validates controls to ensure up-to-date protection. (Source: Knowledge Base)

What is threat exposure prioritization in cybersecurity and how does Cymulate support it?

Threat exposure prioritization is the process of identifying and ranking vulnerabilities based on their exploitability and impact on business-critical assets. Cymulate uses automated threat validation and exposure scoring to help teams focus on exposures not protected by security controls. (Source: Knowledge Base)

How does Cymulate's 'Threat (IoC) updates' feature improve threat resilience?

Cymulate's 'Threat (IoC) updates' feature provides recommended Indicators of Compromise (IoCs) that can be directly applied to security controls. These can be exported via the UI or API, improving threat resilience by enabling rapid defense updates against new threats. (Source: Knowledge Base)

What are the key capabilities of Cymulate's platform?

Cymulate offers continuous threat validation, a unified platform combining Breach and Attack Simulation (BAS), Continuous Automated Red Teaming (CART), and Exposure Analytics, AI-powered optimization, complete kill chain coverage, attack path discovery, automated mitigation, cloud validation, and ease of use. (Source: Knowledge Base)

How does Cymulate automate security validation?

Cymulate automates security validation by running 24/7 attack simulations, integrating with security controls, and providing actionable insights for remediation. This automation reduces manual effort and enables faster, more accurate threat validation. (Source: Knowledge Base)

Does Cymulate support validation for cloud and hybrid environments?

Yes, Cymulate provides dedicated validation features for hybrid and cloud environments, helping organizations address new attack surfaces and validation challenges introduced by cloud adoption. (Source: Knowledge Base)

What integrations does Cymulate offer?

Cymulate integrates with numerous security technologies, including Akamai Guardicore, AWS GuardDuty, BlackBerry Cylance OPTICS, Carbon Black EDR, Check Point CloudGuard, CrowdStrike Falcon, CrowdStrike Falcon LogScale, and Cybereason. For a complete list, visit the Partnerships and Integrations page. (Source: Knowledge Base)

What technical documentation is available for Cymulate?

Cymulate provides whitepapers, guides, solution briefs, data sheets, and e-books covering its Exposure Management Platform, CTEM, threat detection, vulnerability management, and more. Access the full library at the Resource Hub. (Source: Knowledge Base)

Who can benefit from using Cymulate?

Cymulate is designed for CISOs and security leaders, SecOps teams, red teams, and vulnerability management teams across industries such as media, transportation, financial services, retail, and healthcare. Organizations of all sizes, from small businesses to enterprises, can benefit from its platform. (Source: Knowledge Base)

What business impact can customers expect from using Cymulate?

Customers typically see a 30% improvement in threat prevention, a 52% reduction in critical exposures, a 60% increase in team efficiency, 40X faster threat validation, and an 81% reduction in cyber risk within four months. (Source: Knowledge Base)

Are there case studies demonstrating Cymulate's effectiveness?

Yes. For example, Hertz Israel reduced cyber risk by 81% in four months, Nemours Children's Health improved detection and response, and a financial services organization automated testing across 10+ entities. See more at the Cymulate Customers page. (Source: Knowledge Base)

How does Cymulate help with communication barriers for CISOs?

Cymulate provides validated exposure scoring and quantifiable metrics, enabling CISOs to justify investments and communicate risk to stakeholders more effectively. (Source: Knowledge Base)

How easy is it to implement Cymulate and get started?

Cymulate is easy to implement, with customers reporting that deployment is fast and straightforward. The platform supports agentless mode, quick deployment, and requires minimal resources, allowing organizations to start running simulations almost immediately. (Source: Knowledge Base)

What feedback have customers given about Cymulate's ease of use?

Customers consistently praise Cymulate for its intuitive design, user-friendly dashboard, and ease of deployment. Testimonials highlight the platform's simplicity and the effectiveness of its support team. (Source: Knowledge Base)

What core problems does Cymulate solve for security teams?

Cymulate addresses overwhelming volumes of threats, lack of visibility, unclear prioritization, operational inefficiencies, fragmented security tools, cloud complexity, and communication barriers for CISOs. (Source: Knowledge Base)

How does Cymulate address the pain points of different personas?

Cymulate tailors its solutions for CISOs (visibility and metrics), SecOps (operational efficiency), red teams (scalable offensive testing), and vulnerability management teams (prioritization and resource optimization). (Source: Knowledge Base)

What problems does Cymulate's Threat Validation solution solve?

It addresses lack of confidence in security controls and security configuration drift, ensuring defenses are validated against the latest threats and configurations remain effective. (Source: Knowledge Base)

What security and compliance certifications does Cymulate hold?

Cymulate is SOC2 Type II certified and complies with ISO 27001:2013, ISO 27701, ISO 27017, and CSA STAR Level 1. These certifications cover security, privacy, and cloud service best practices. (Source: Knowledge Base)

How does Cymulate ensure data security and privacy?

Cymulate hosts services in secure AWS data centers, uses encryption for data in transit (TLS 1.2+) and at rest (AES-256), and follows a strict Secure Development Lifecycle (SDLC). The company also complies with GDPR and has a dedicated privacy and security team. (Source: Knowledge Base)

What is Cymulate's pricing model?

Cymulate uses a subscription-based pricing model tailored to each organization's needs. Pricing depends on the chosen package, number of assets, and scenarios selected. For a quote, schedule a demo. (Source: Knowledge Base)

How does Cymulate compare to AttackIQ?

Cymulate offers an industry-leading threat scenario library and AI-powered capabilities for workflow automation and security posture improvement. AttackIQ focuses on automated security validation but lacks Cymulate's innovation, threat coverage, and ease of use. Read more. (Source: Knowledge Base)

How does Cymulate compare to Mandiant Security Validation?

Mandiant is one of the original BAS platforms but has seen little innovation in recent years. Cymulate continually innovates with AI and automation, expanding into exposure management and recognized as a grid leader. Read more. (Source: Knowledge Base)

How does Cymulate compare to Pentera?

Pentera is useful for attack path validation but lacks the depth Cymulate provides for fully assessing and strengthening defenses. Cymulate optimizes defense, scales offensive testing, and increases exposure awareness. Read more. (Source: Knowledge Base)

How does Cymulate compare to Picus Security?

Picus may suit organizations seeking a BAS vendor with an on-prem option. Cymulate offers a more complete exposure validation platform covering the full kill chain and cloud control validation. Read more. (Source: Knowledge Base)

How does Cymulate compare to SafeBreach?

Cymulate outpaces SafeBreach with unmatched innovation, precision, and automation. It features the industry’s largest attack library, a full CTEM solution, and comprehensive exposure validation. Read more. (Source: Knowledge Base)

How does Cymulate compare to Scythe?

Scythe is suitable for advanced red teams building custom attack campaigns. Cymulate provides a more comprehensive exposure validation platform with actionable remediation and automated mitigation. Read more. (Source: Knowledge Base)

How does Cymulate compare to NetSPI?

NetSPI excels in penetration testing as a service (PTaaS). Cymulate is designed for continuous, independent assessment and strengthening of defenses, recognized as a leader in exposure validation by Gartner and G2. Read more. (Source: Knowledge Base)

What is Cymulate's mission and vision?

Cymulate's mission is to revolutionize how companies approach cybersecurity by fostering a proactive stance against threats. The company empowers organizations to manage their security posture effectively and improve resilience against threats. (Source: Knowledge Base)

What is Cymulate's company background and viability?

Founded in 2016, Cymulate has a presence in 8 global locations, serves customers in 50 countries, and is trusted by over 1,000 customers. The company demonstrates strong growth and continuous innovation, updating its platform every two weeks. (Source: Knowledge Base)

Albanian Government Organizations Targeted By Possible Iranian Threat Actors

August 9, 2022

Mandiant identified a new ransomware family dubbed ROADSWEEP which drops a politically themed ransom note suggesting it targeted the Albanian government.
In addition, a front named "HomeLand Justice" claimed credit for the disruptive activity that affected Albanian government websites and citizen services on July 18, 2022.
The "HomeLand Justice" front posted a video of the ransomware being executed on its website and Telegram channel alongside alleged Albanian government documents and residence permits of ostensible members of the Mujahedeen-e-Khalq/People's Mojahedin Organization of Iran (MEK, also known as MKO or PMOI), an Iranian opposition organization that was formerly designated as a terrorist group by the U.S.
Department of State.

CHIMNEYSWEEP: A Backdoor with Extensive Capabilities

Mandiant further identified CHIMNEYSWEEP, a backdoor that uses either Telegram or actor-owned infrastructure for command-and-control and is capable of taking screenshots, listing and collecting files, spawning a reverse shell, and supports keylogging functionality.
CHIMNEYSWEEP shares code with ROADSWEEP and based on observed decoy content has likely been used to target Farsi and Arabic speakers as far back as 2012.

Code Similarities Between CHIMNEYSWEEP and ROADSWEEP

CHIMNEYSWEEP and ROADSWEEP share multiple code overlaps, including identical dynamic API resolution code.
The shared code includes an embedded RC4 key to decrypt Windows API function strings at run time, which are resolved using LoadLibrary and GetProcAddress calls once decrypted.
Both capabilities also share the same Base64 custom alphabet, one used to encode the decryption key, the other for command and control.
Both CHIMNEYSWEEP and ROADSWEEP use the RC4 key "8c e4 b1 6b 22 b5 88 94 aa 86 c4 21 e8 75 9d f3" and the custom Base64 alphabet "wxyz0123456789.-JKLMNOPghijklmnopqrstuvQRSTUVWXYZabcdefABCDEFGHI".

CHIMNEYSWEEP’s Deployment and Decoy Documents

CHIMNEYSWEEP is dropped by a self-extracting archive signed with a valid digital certificate alongside either an Excel, Word, or video file which are likely used as benign decoy documents.
However, these documents do not appear to be automatically opened when CHIMNEYSWEEP is executed.
The decoy documents have included Arabic-language lists of names, ostensibly of individuals in Lebanon, and a figure of Massoud Rajavi, the former leader of the Mujahedeen-e-Khalq (MEK), an Iranian opposition group

The Connection to ZEROCLEAR Wiper

One day after the Albanian government announcement of the disruptive activity, an Albanian user submitted a ZEROCLEAR wiper payload to a public malware repository.
The ZEROCLEAR payload takes in command line arguments from the operator and results in corruption of the file system using the RawDisk driver.

While MANDIANT is unable to independently prove or disprove whether the ZEROCLEAR sample was used in this or any disruptive operation, the malware has previously been publicly reported to have links to Iran-nexus threat actors deploying it in support of disruptive activity in the Middle East as recently as 2020.

Featured Resources

View More Resources

blog

CVE-2026-7791: Privileged by Default

Amazon WorkSpaces flaw CVE-2026-7791 lets low-privileged users gain SYSTEM access via Skylight service abuse.