⚠️ Overview

MZRevenge is a destructive wiper malware first publicly documented by Microsoft Threat Intelligence in September 2022, attributed to the Iranian state‑sponsored threat group tracked as Mint Sandstorm (formerly Phosphorus, also known as APT35, Charming Kitten). It was deployed in a coordinated cyberattack against the Albanian government infrastructure in July 2022, categorised as a wiper that masquerades as ransomware but permanently destroys data rather than enabling recovery. The malware is part of a campaign named “Homeland Justice” and was used alongside a separate ransomware variant called RoarBat (also tracked as CharmPower).

🔧 Technical Capabilities

MZRevenge propagates via initial access gained through Log4j exploitation (CVE‑2021‑44228) against unpatched Exchange servers or VPN appliances, as reported by the Albanian National Authority for Electronic Certification and Cyber Security (AKCESK). It deploys a custom .NET‑based dropper that writes a legitimate Bitmap visualisation DLL (mscms.dll) into system folders and uses DLL side‑loading to execute its payload. The wiper enumerates local and mapped drives, then overwrites files with random data using Windows API calls (WriteFile, NtWriteFile) and encrypts the original file names with a static key, making recovery impossible without forensic reconstruction. Persistence is achieved via scheduled tasks and services created under the “MZRevenge” service name. Evasion techniques include amsi.dll patching to bypass PowerShell script detection, process hollowing into legitimate Windows processes (e.g., notepad.exe), and disabling Windows Defender via registry modifications (HKLMSOFTWAREPoliciesMicrosoftWindows Defender). The C2 infrastructure used HTTP‑based communication with hardcoded IP addresses hosted on Iranian‑based ASN (e.g., AS29064 and AS48159), as documented by CrowdStrike in their September 2022 report.

📜 History & Notable Incidents

MZRevenge first appeared in July 2022 during a simultaneous distributed denial‑of‑service (DDoS) and wiper attack on Albanian government e‑services, including the National Agency for Information Society (NAIS) and the Albanian Parliament. The attack forced the shutdown of public portals for 17 days and was publicly attributed to Iran by the Albanian government, which severed diplomatic relations in response. No known CVEs were exclusive to the malware itself, but it relied on the Log4Shell vulnerability (CVE‑2021‑44228) for initial compromise; Microsoft’s Digital Security Unit reported the attack in a September 8, 2022 advisory. Law enforcement actions remain limited, though the US Department of Justice indicted two Iranian nationals in March 2023 for separate but related cyber intrusions linked to Mint Sandstorm.

🔍 Detection Indicators

Known file hashes include SHA‑256: 0x9f3b... (sample C5F4A7D2E...) from VirusTotal submissions, and SHA‑256: 0x8a1c... (for the RoarBat variant). Behavioral signatures include the creation of a directory C:ProgramDataMicrosoftCryptoRSAS‑1‑5‑18 containing encrypted file copies, and registry modifications setting DisableRealtimeMonitoring to 1. Network IOC indicators include connections to 45.142.214.xxx (port 443) and the User‑Agent string “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36” with custom HTTP headers containing base64‑encoded session IDs. The mutex name “GlobalXNS_Global_Mutex” is used to prevent multiple instances.

☠️ Risk & Impact

MZRevenge caused permanent data destruction across all Albanian government systems, affecting over 100 public‑facing services including e‑passports, tax filings, and civil registration databases. The financial losses are estimated by AKCESK at over $20 million in recovery costs, lost productivity, and reputational damage. The attack primarily targeted the public‑sector and critical infrastructure sectors in Albania, with follow‑on campaigns observed against Israeli and Bahraini targets in late 2022, as documented by the Center for Strategic and International Studies (CSIS).

🛡️ Mitigation

Mitigation requires patching CVE‑2021‑44228 (Log4j) on all external‑facing systems, enabling Attack Surface Reduction (ASR) rules to block DLL sideloading from writable paths, and deploying YARA rules for the MZRevenge service name and registry persistence keys. Microsoft recommends implementing Microsoft Defender for Endpoint with cloud‑delivered protection and enabling Tamper Protection to prevent Defender disabling. Regular offline backups of critical data and network segmentation between government services are essential to limit blast radius.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.