Apostle
Apostle is a .NET malware family associated with the Iran-linked threat actor Agrius and used primarily in attacks against Israeli targets, with reporting also indicating use against a critical facility in the United Arab Emirates. It was initially observed as a destructive wiper disguised as ransomware: early variants lacked real decryption capability and were intended to destroy data while presenting the incident as financially motivated. Later variants were modified into fully functional ransomware, though multiple sources assess the ransomware functionality was primarily meant to mask sabotage and complicate attribution and incident response rather than support genuine monetization.
Reported Agrius intrusion tradecraft includes exploitation of public-facing applications, deployment of ASPXSpy-based webshells, tunneling of RDP traffic, use of public offensive tools for credential theft and lateral movement, and use of ProtonVPN for anonymization. Apostle has been linked to incidents including attacks on Israeli organizations and the Bar-Ilan University ransomware attack.
Apostle’s behavior includes persistence via creation of a scheduled task such as MicrosoftCrashHandlerUAC; searching available drives for files matching a hard-coded extension list; creating encrypted copies of files and deleting the originals; and renaming encrypted output to random GUID filenames with a .lock extension. Reporting on its destructive mode states that it writes random data to original files after creating an encrypted copy, resizes the original file to zero, alters time metadata, and then deletes the original file. It writes batch scripts such as system.bat and remover.bat to perform anti-analysis and anti-forensic tasks, deletes those scripts after execution, attempts to delete itself after encryption or wiping activity, deletes Windows event logs following file wipe activity, and reboots the victim machine after wiping-related actions.
A ransomware-capable variant requires a base64-encoded argument at execution; if the argument is absent, Apostle self-deletes. In the Bar-Ilan-related reporting, a newer Apostle variant was delivered by a .NET loader named Jennlog, which concealed the payload in fake log-file resources, performed anti-analysis and optional victim fingerprint checks, then decrypted and executed Apostle in memory. That variant’s ransom note demanded $10,000 in Monero and directed victims to a Telegram contact at hxxps://t[.]me/x4ran, and it reportedly changed the victim wallpaper to an image of a clown.
Apostle is also reported to share significant .NET code characteristics with Agrius’s custom backdoor IPsec Helper, and SentinelLabs assessed the two were likely written by the same developer.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Agrius actors also dropped a novel wiper named ‘Apostle’... Later intrusions carried out by Agrius revealed they kept maintaining and improving Apostle, turning it into a fully functional ransomware.
Techniques & procedures
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Persistence
3 techniques
Persistence
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Privilege Escalation
2 techniques
Privilege Escalation
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
Stealth
10 techniques
Stealth
The content contains many examples of base64, XOR, RC4, AES, Rijndael, custom ciphers, rolling XOR, and multi-layer obfuscation used to hide payloads, strings, scripts, and C2 data.
The new version of Apostle is obfuscated, encrypted and compressed as a resource in a loader we call Jennlog, as it attempts to masquerade payload in resources as log files.
APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.
Many examples describe post-intrusion cleanup, anti-forensics, and removal of artifacts such as logs, scripts, malware components, scheduled tasks, registry keys, and temporary files.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Discovery
2 techniques
Discovery
Command and Control
1 technique
Command and Control
Impact
6 techniques
Impact
Initially engaged in espionage activity, Agrius deployed a set of destructive wiper attacks against Israeli targets, masquerading the activity as ransomware attacks.
Later intrusions carried out by Agrius revealed they kept maintaining and improving Apostle, turning it into a fully functional ransomware... In some cases, the group leveraged its access to deploy destructive wiper malware, and in others a custom ransomware.
Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files. LockBit 3.0 can identify and terminate specific services. RansomHub can stop processes associated with files currently in use to maximize the impact of encryption.
"AcidPour includes functionality to reboot the victim system following wiping actions..."; "AcidRain reboots the target system once the various wiping processes are complete"; "Apostle reboots the victim machine following wiping"; "APT37 ... issue the command shutdown /r /t 1 to reboot a system after wiping its MBR"; "APT38 ... BOOTWRECK ... initiate a system reboot after wiping the victim's MBR"; "Black Basta ... used ShellExecuteA to shut down and restart"; "DarkGate ... used the shutdown command"; "HermeticWiper can initiate a system shutdown"; "NotPetya will reboot the system one hour after infection"; "Shamoon will reboot the infected system once the wiping functionality has been completed"; "WhisperGate can shutdown ... through ... ExitWindowsEx"
IOCs tracked for this family
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Originally a data wiper, later modified to operate as a ransomware variant and used in pseudo-ransomware attacks that disguise destructive activity as financial extortion.
Originally a wiper masquerading as ransomware, Apostle later evolved into functioning ransomware, blurring the line between destructive sabotage and extortion.
An Iran-linked wiper malware family identified in the content as part of a broader destructive cyber capability focused on data destruction and disruption.
Destructive wiper malware previously deployed by Iranian operators against organizations in the Middle East.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.