Justice Blade
Attribution profile
- Type
- Activist
- Location
- Iran
- Known incidents
- 6 incidents
- Sources
- 1 source
- First seen
- 2022-07-15
- Last seen
- 2025-06-20
- Updated
- 2026-10-14 08:28
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Justice Blade, also known as Homeland Justice, is an Iran‑based hacker group that has claimed responsibility for cyber operations against Albanian government institutions and Saudi‑Arabian IT service providers. The group’s activities appear ideologically motivated, with no observed financial gain or ransom demands. It targets public‑sector entities such as municipal administrations, national parliaments, and outsourcing firms that support government and critical‑industry clients in the GCC, seeking to extract data, disrupt services, and leak information. Observed tactics include compromising employee credentials for initial access, moving laterally through Active Directory and internal applications, deploying the Metasploit Framework post‑compromise, defacing public websites, establishing Telegram channels for data dissemination, and, in some cases, wiping servers. Notable campaigns include the June 2025 Tirana City Hall website outage and data wipe, the November 2023 Albanian Parliament service disruption, and the November 2022 breach of Smart Link BPO Solutions that exposed over 100 000 records tied to regional airlines and a central‑bank initiative. Public attribution notes the group’s Iranian origin, but the source material does not explicitly state a state‑sponsorship link.
Incidents
Attributed incidents are available to members.
6 incidentsSources
Sources available to members: 1 source.