H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

ZeroCleare

[ZeroCleare](https://attack.mitre.org/software/S1151) is a wiper malware that has been used in conjunction with the [RawDisk](https://attack.mitre.org/software/S0364) driver since at least 2019 by suspected Iran-nexus threat actors including activity targeting the energy and industrial sectors in the Middle East and political targets in Albania.(Citation: Microsoft Albanian Government Attacks September 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Mandiant ROADSWEEP August 2022)(Citation: IBM ZeroCleare Wiper December 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[ZeroCleare](https://attack.mitre.org/software/S1151) is a wiper malware that has been used in conjunction with the [RawDisk](https://attack.mitre.org/software/S0364) driver since at least 2019 by suspected Iran-nexus threat actors including activity targeting the energy and industrial sectors in the Middle East and political targets in Albania.(Citation: Microsoft Albanian Government Attacks September 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Mandiant ROADSWEEP August 2022)(Citation: IBM ZeroCleare Wiper December 2019)

Labels

malware
10 recorded

Relationships

uses
from HomeLand Justice
Campaign
uses
from OilRig
Group
uses
to Code Signing
Technique
uses
to Command and Scripting Interpreter
Technique
uses
to Disk Structure Wipe
Technique
uses
to Exploitation for Privilege Escalation
Technique
uses
to File Deletion
Technique
uses
to Local Storage Discovery
Technique
uses
to Native API
Technique
uses
to PowerShell
Technique
6 external

References

mitre-attack
S1151
open
ZEROCLEAR
—
CISA Iran Albanian Attacks September 2022
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a
open
Mandiant ROADSWEEP August 2022
https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/
open
IBM ZeroCleare Wiper December 2019
https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/
open
Microsoft Albanian Government Attacks September 2022
https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance