Iran-Linked Hackers Target Albanian Parliament

Albania's Parliament has reported a cyberattack in which Iran-based hackers attempted access to its data server, seeking to erase critical information. 

A statement said Monday’s cyberattack, which temporarily halted parliament’s operations, had not “touched the data of the system.” The Associated Press cited local media as reporting that a cellphone provider and an air flight company were also targeted by cyberattacks Monday from “Iranian-based hackers called Homeland Justice.”

In the announcement published on the Telegram account of the group, 'Homeland Justice' claims to have deleted more than 2 petabytes of data of the telecommunications network and the internal network of all connected companies.

Iran International cannot independently verify if the hacker group is affiliated with Iran, but Albania has a history of being caught in the crossfire between the Islamic Republic and the Iranian exiled opposition group Mujahedeen-e-Khalq (MEK), currently based in Manza, an Albanian city near Durrës. In an X post after the parliament cyberattack, the hacker group called to “Destroy Durres Military Camp.”

In July 2022, Albania suffered a cyberattack that the government and multinational technology companies blamed on hackers linked to the Iranian Foreign Ministry. Believed to be in retaliation for Albania sheltering members of the MEK, the attack prompted the government to cut diplomatic relations with Iran two months later.

In June, the Albanian State Police, on the orders of the Special Court, raided the MEK camp, resulting in clashes between its residents and security forces. The police confiscated a large number of electronic and storage devices allegedly linked to prohibited political activities.Iran said earlier in the year that the storage devices were handed over to Tehran, but Albania denied the claim.

In one of their statements, the hacker group said, “Ignoring our 'humanitarian warnings cost your corrupt politicians all this. But don’t be fooled. This will continue until we completely clear the country of terrorists,” an apparent reference to the MEK. The group was on the US Foreign Terrorist Organization (FTO) list until 2012.

In recent years, MEK-affiliated hacktivist group ‘Uprising till Overthrow’ has breached hundreds of websites and servers belonging to the Iranian government such the office of the president and the foreign ministry, releasing troves of classified documents. In June 2022, it hacked over 5,000 security cameras of state bodies and 150 websites belonging to Tehran Municipality. The hack came after another cyberassault in March on the portal of the Ministry of Culture and Islamic Guidance (Ershad) and its affiliated websites. The attackers posted messages calling for the death of the country’s supreme leader.

MEK, a revolutionary organization with a Marxist-Islamist ideology emerged before the Iranian revolution in 1979 and for a time supported the new Islamist government in Tehran. But soon the ruling clerics decided they would not tolerate leftists and other organizations remaining active and launched bloody repression. MEK was exiled and many found refuge in Iraq under Saddam Hussein who helped them continue their fight against the government in Tehran. Since 2013, some 2,500 of the MEK members are sheltered in Albania, where they are not supposed to engage in any political activity and must abide by the country’s laws.