On 15 July 2022 a cyberattack temporarily shut down a large number of Albanian government digital services and websites. Reporting describes a toolkit combining a previously unknown backdoor named Chimneysweep, a variant of the Zeroclear wiper, and a ransomware family named Roadsweep. A persona called Homeland Justice claimed the attack, presenting itself as Albanian citizens objecting to the country hosting members of the Iranian opposition group MEK.
On 6 September 2022 Prime Minister Edi Rama announced Albania was severing diplomatic relations with Iran, ordering embassy staff out within 24 hours. Reporting describes this as the first known instance of a state cutting diplomatic ties over a cyberattack. A second attack followed days later.
The Response Was The Precedent
The intrusion itself is not extraordinary by this corpus’s standards — government services disrupted, a wiper, a ransomware veneer over what looks like destruction rather than extortion.
What makes it a file is that a state treated it as grounds for the most serious peacetime diplomatic act short of expulsion from an alliance. We have recorded the escalation ladder’s other rung at 22-0508, where Costa Rica declared a national emergency. Both are states reaching past the security apparatus into instruments built for something else, because the instruments built for this do not exist.
Ransomware As Costume
A ransomware family was deployed alongside a wiper, and a persona claimed the attack as domestic activism. Neither element appears to have been the objective.
We have recorded the same technique at 23-0125 and 22-0224, where destruction was the goal and the criminal framing was cover. Attribution difficulty is not a side effect here; it is a designed property of the operation, and it is why the corpus grades attribution separately from events throughout.
A NATO Member, And The Question Nobody Answered
Albania is a NATO member, and the alliance’s collective defence provisions have long been described as potentially applicable to cyber operations without any threshold ever being specified.
The threshold was not tested here. That is the durable observation: the response came from Tirana bilaterally rather than from the alliance, which tells you where the practical line sat in 2022 — well above disruption of a member state’s public services. This desk records that as an observation about what happened, not as a legal reading.
Compiled from contemporaneous reporting of the attack and the diplomatic response, listed below. The Albanian government attributed the attack to Iran; this desk records that attribution as the position of a state that acted on it, not as established fact. The characterisation of this as the first such diplomatic break is widely reported and this desk has found no prior instance, but it is carried as a reported claim. No damage or cost figure is asserted — none was published in a form this desk can carry. Graded high on the events. Corrections: corrections@forensicpost.com.