Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · HomeLand Justice · Unknown · assessed origin Iran · misp-galaxy · refreshed 2026-10-06

HomeLand Justice

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2019-0604

Analyst brief

misp-galaxy

HomeLand Justice is an Iranian state-sponsored cyber threat group that has been active since at least May 2021. They have targeted various organizations, including a well-known telecommunication company and the Albanian Parliament. The group engaged in information operations and messaging campaigns to amplify the impact of their attacks.

CVEs cited sources tie to HomeLand Justice

1 on CISA KEV
  1. CVE-2019-0604KEV2026-10-17
    1. “For HomeLand Justice , threat actors exploited CVE-2019-0604 in Microsoft SharePoint for initial access.”

      cited as used in a campaign · source: attack.mitre.org ↗ · 2026-10-17

    2. “In their cyber attacks, HomeLand Justice group gained initial access to the victim's network by exploiting the Microsoft SharePoint CVE-2019-0604 vulnerability.”

      cited as exploiting · source: picussecurity.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

3 sources
  1. 1.picussecurity.com/resource/blog/cisa-alert-aa22-264a-iranian-homeland-ju…
  2. 2.attackiq.com/2022/09/23/attack-graph-response-to-us-cert-alert-aa22…
  3. 3.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-po…

Track HomeLand Justice on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.