APT / THREAT GROUP

ZeroCleare

aliases

Last seen:Mar 17, 2026

Intelligence Profile

ZeroCleare is a destructive malware. It has been developed in order to wipe the master boot record section in order to damage a disk's partitioning. Attackers use the EldoS RawDisk driver to perform the malicious action, which is not a signed driver and would therefore not runnable by default. The attackers managed to install it by using a vulnerable version of VBoxDrv driver, which the DSE accepts and runs. Used to attack middle-east energy and industrial sectors.

Threat Analysis

ZeroCleare is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/

→https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/

→https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat

→https://www.ibm.com/downloads/cas/OAJ4VZNJ

→https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

ZeroClearewin.zerocleare

External Intelligence

Malpedia: win.zerocleare

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search ZeroCleare