ZeroCleare
- ID
- S1151
- Type
- Malware
- Associated names
- ZEROCLEAR
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 5 Sep 2024
ZeroCleare is a wiper malware that has been used in conjunction with the RawDisk driver since at least 2019 by suspected Iran-nexus threat actors including activity targeting the energy and industrial sectors in the Middle East and political targets in Albania.[1][2][3][4]
Techniques used (8)
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1068 Exploitation for Privilege Escalation
- T1070.004 File Deletion
- T1106 Native API
- T1553.002 Code Signing
- T1561.002 Disk Structure Wipe
- T1680 Local Storage Discovery