S1151 ZeroCleare

malwareEnterprise

platformsWindows

also known asZeroCleare · ZEROCLEAR

ZeroCleare is a wiper malware that has been used in conjunction with the RawDisk driver since at least 2019 by suspected Iran-nexus threat actors including activity targeting the energy and industrial sectors in the Middle East and political targets in Albania.

techniques used (8)

ATT&CK techniques this enables or maps to.

T1059Command and Scripting Interpreter
T1059.001PowerShell
T1068Exploitation for Privilege Escalation
T1070.004File Deletion
T1106Native API
T1553.002Code Signing
T1561.002Disk Structure Wipe
T1680Local Storage Discovery

used by groups (1)

Threat groups associated with this.

G0049OilRig

used by campaigns (1)

Campaigns that use this.

C0038HomeLand Justice

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan