ZeroCleare

MITRE ATT&CK: S1151 View on attack.mitre.org

Aliases: ZEROCLEAR, ZeroCleare

First seen: 2019-01-01 00:00:00
Malware type: wiper
Family: Malware family
Operating systems: windows
Profile updated: 2026-07-07 12:37:34

Targeted industries: energy-and-utilities government-and-public-sector

Targeted regions: country_code:ae country_code:sa country_code:al

Context

ZeroCleare is a wiper malware that has been used in conjunction with the RawDisk driver since at least 2019 by suspected Iran-nexus threat actors including activity targeting the energy and industrial sectors in the Middle East and political targets in Albania.

Detection coverage

1 YARA rules
294 Sigma rules

Malware & tools used

Local Storage Discovery (attack-pattern)
Exploitation for Privilege Escalation (attack-pattern)
Code Signing (attack-pattern)
Command and Scripting Interpreter (attack-pattern)
Native API (attack-pattern)
File Deletion (attack-pattern)
PowerShell (attack-pattern)
Disk Structure Wipe (attack-pattern)

Used by threat actors

HomeLand Justice (campaign)
OilRig (threat-actor)

Detection rules

MALPEDIA_Win_Zerocleare_Auto (yara-rule)

Reports & references

pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
Microsoft — Microsoft Investigates Iranian Attacks Against The Albanian Government (report)
pwc.co.uk — Cyber Threats 2019 Retrospect (report)
securityintelligence.com — New Destructive Wiper Zerocleare Targets Energy Sector In The Middle East (report)
fortinet.com — The Increasing Wiper Malware Threat (report)
CrowdStrike — The Anatomy Of Wiper Malware Part 1 (report)
CrowdStrike — The Anatomy Of Wiper Malware Part 3 (report)
malpedia.caad.fkie.fraunhofer.de — Win.Zerocleare (report)
ibm.com — Oaj4Vznj (report)
cloud.google.com — Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against (report)
MITRE ATT&CK — S1151 (report)
CISA — Aa22 264A (report)
Microsoft — Microsoft Investigates Iranian Attacks Against The Albanian Government (report)