Pink_Sandstorm__2024__Agonizing_Serpens_Aka_Agrius_Targeting_the_Israeli_Higher_Education_and_Tech_Sectors.pdf

Unit 42 details an Iranian-linked APT operation by Agonizing Serpens that targeted Israeli higher education and technology sectors from January to October 2023, employing web shells for initial access, credential theft, lateral movement, and exfiltration, followed by multiple destructive wipers (MultiLayer, PartialWasher, BFG Agonizer) designed to erase data, degrade systems, and hinder recovery. The group attempted to evade defenses like Cortex XDR/XSIAM and used various publicly available tools in combination with custom tooling, resulting in a highly sophisticated 'scorched earth' campaign with indicators of compromise and recommended detections and mitigations.