evol-agrius.pdf

SentinelLabs details Agrius, a suspected Iran-linked threat actor active since 2020 that shifted from espionage to destructive operations against Israeli and regional targets, using custom tools (IPsec Helper backdoor, Apostle wiper/ransomware) and the DEADWOOD wiper; the report includes technical analysis, attack lifecycle, IOCs (samples, mutexes, service names, C2 URLs, IPs), YARA detections, and mitigation-relevant TTPs.