ZeroCleare

Description

ZeroCleare is a destructive data wiper that hit energy and government organizations in the Middle East in 2019, which researchers attributed to Iranian state sponsored actors. It overwrote the master boot record and system files on infected Windows systems to destroy data and disrupt operations rather than to demand ransom.

Stats

First seen: March 2022
Last seen: September 2026

Also known as

Zerocleare

MITRE ATT&CK techniques

8 techniques across 6 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.001PowerShell
T1106Native API

TA0004 Privilege Escalation

T1068Exploitation for Privilege Escalation

TA0005 Stealth

T1070Indicator Removal
- T1070.004File Deletion

TA0007 Discovery

T1680Local Storage Discovery

TA0040 Impact

T1561Disk Wipe
- T1561.002Disk Structure Wipe

TA0112 Defense Impairment

T1553Subvert Trust Controls
- T1553.002Code Signing

Associated groups

G0049OilRig

Associated campaigns

C0038HomeLand Justice

Alert name variants

Alert Name	Engine
Win32.Trojan.ZeroCleare	ATP Sandbox Adv. Heuristics
Win64.Trojan.Zerocleare	ATP Sandbox Adv. Heuristics
Win64.Trojan.ZeroCleare	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-OTHER Win.Trojan.ZeroCleare variant payload download attempt	IPS-SWG

Related families

HermeticWiper WhisperGate Bazar Black Basta Cobalt Strike