Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareRansomwareUsed by 1 actor

Apostle

Apostle is a .NET malware family associated with the Iran-linked threat actor Agrius and used primarily in attacks against Israeli targets, with reporting also indicating use against a critical facility in the United Arab Emirates. It was initially observed as a destructive wiper disguised as ransomware: early variants lacked real decryption capability and were intended to destroy data while presenting the incident as financially motivated. Later variants were modified into fully functional ransomware, though multiple sources assess the ransomware functionality was primarily meant to mask sabotage and complicate attribution and incident response rather than support genuine monetization.

Reported Agrius intrusion tradecraft includes exploitation of public-facing applications, deployment of ASPXSpy-based webshells, tunneling of RDP traffic, use of public offensive tools for credential theft and lateral movement, and use of ProtonVPN for anonymization. Apostle has been linked to incidents including attacks on Israeli organizations and the Bar-Ilan University ransomware attack.

Apostle’s behavior includes persistence via creation of a scheduled task such as MicrosoftCrashHandlerUAC; searching available drives for files matching a hard-coded extension list; creating encrypted copies of files and deleting the originals; and renaming encrypted output to random GUID filenames with a .lock extension. Reporting on its destructive mode states that it writes random data to original files after creating an encrypted copy, resizes the original file to zero, alters time metadata, and then deletes the original file. It writes batch scripts such as system.bat and remover.bat to perform anti-analysis and anti-forensic tasks, deletes those scripts after execution, attempts to delete itself after encryption or wiping activity, deletes Windows event logs following file wipe activity, and reboots the victim machine after wiping-related actions.

A ransomware-capable variant requires a base64-encoded argument at execution; if the argument is absent, Apostle self-deletes. In the Bar-Ilan-related reporting, a newer Apostle variant was delivered by a .NET loader named Jennlog, which concealed the payload in fake log-file resources, performed anti-analysis and optional victim fingerprint checks, then decrypted and executed Apostle in memory. That variant’s ransom note demanded $10,000 in Monero and directed victims to a Telegram contact at hxxps://t[.]me/x4ran, and it reportedly changed the victim wallpaper to an image of a clown.

Apostle is also reported to share significant .NET code characteristics with Agrius’s custom backdoor IPsec Helper, and SentinelLabs assessed the two were likely written by the same developer.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Mustang Panda

Agrius actors also dropped a novel wiper named ‘Apostle’... Later intrusions carried out by Agrius revealed they kept maintaining and improving Apostle, turning it into a fully functional ransomware.

via sentinelone labssentinelone.com
MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1190Exploit Public-Facing ApplicationEvidence2

As in previous attacks, the threat actors gained entry via public-facing web servers and the deployment of “unique variants of ASPXSPY”

Execution

2 techniques
T1053Scheduled Task/JobEvidence1

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

T1053.005Scheduled TaskEvidence3

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

Persistence

3 techniques
T1053Scheduled Task/JobEvidence1

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

T1053.005Scheduled TaskEvidence3

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

T1505.003Web ShellEvidence1

Agonizing Serpens frequently exploited publicly available one-day vulnerabilities in public-facing web applications to drop custom web shells.

Privilege Escalation

2 techniques
T1053Scheduled Task/JobEvidence1

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

T1053.005Scheduled TaskEvidence3

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

Stealth

10 techniques
T1027Obfuscated Files or InformationEvidence3

The content contains many examples of base64, XOR, RC4, AES, Rijndael, custom ciphers, rolling XOR, and multi-layer obfuscation used to hide payloads, strings, scripts, and C2 data.

T1027.009Embedded PayloadsEvidence1

The new version of Apostle is obfuscated, encrypted and compressed as a resource in a loader we call Jennlog, as it attempts to masquerade payload in resources as log files.

T1036MasqueradingEvidence1

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

T1070Indicator RemovalEvidence3

Many examples describe post-intrusion cleanup, anti-forensics, and removal of artifacts such as logs, scripts, malware components, scheduled tasks, registry keys, and temporary files.

T1070.001Clear Windows Event LogsEvidence1
T1070.004File DeletionEvidence5

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

T1140Deobfuscate/Decode Files or InformationEvidence4

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

T1480Execution GuardrailsEvidence1
T1497Virtualization/Sandbox EvasionEvidence1

Before executing the Apostle payload, Jennlog runs a set of tests to verify that it is not being executed in an analysis environment based on an embedded configuration.

T1620Reflective Code LoadingEvidence1

The extracted content found in this sample is a new version of the Apostle ransomware, which is loaded into memory and ran using the parameters given to Jennlog at execution.

Discovery

2 techniques
T1057Process DiscoveryEvidence2

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

T1497Virtualization/Sandbox EvasionEvidence1

Before executing the Apostle payload, Jennlog runs a set of tests to verify that it is not being executed in an analysis environment based on an embedded configuration.

Command and Control

1 technique
T1105Ingress Tool TransferEvidence1

It can be used to exfiltrate data or deploy additional malware.

Impact

6 techniques
T1485Data DestructionEvidence8

Initially engaged in espionage activity, Agrius deployed a set of destructive wiper attacks against Israeli targets, masquerading the activity as ransomware attacks.

T1486Data Encrypted for ImpactEvidence6

Later intrusions carried out by Agrius revealed they kept maintaining and improving Apostle, turning it into a fully functional ransomware... In some cases, the group leveraged its access to deploy destructive wiper malware, and in others a custom ransomware.

T1489Service StopEvidence1

Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files. LockBit 3.0 can identify and terminate specific services. RansomHub can stop processes associated with files currently in use to maximize the impact of encryption.

T1529System Shutdown/RebootEvidence2

"AcidPour includes functionality to reboot the victim system following wiping actions..."; "AcidRain reboots the target system once the various wiping processes are complete"; "Apostle reboots the victim machine following wiping"; "APT37 ... issue the command shutdown /r /t 1 to reboot a system after wiping its MBR"; "APT38 ... BOOTWRECK ... initiate a system reboot after wiping the victim's MBR"; "Black Basta ... used ShellExecuteA to shut down and restart"; "DarkGate ... used the shutdown command"; "HermeticWiper can initiate a system shutdown"; "NotPetya will reboot the system one hour after infection"; "Shamoon will reboot the infected system once the wiping functionality has been completed"; "WhisperGate can shutdown ... through ... ExitWindowsEx"

T1561Disk WipeEvidence1

Iran has a new cyber trick in the form of destructive smokescreens that leverage ransomware-style encryption to disguise data destruction, sabotage, or political retribution.

T1561.001Disk Content WipeEvidence1
INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
hash.md5●●●●●●●●●●●●View more in app5 years ago
hash.sha1●●●●●●●●●●●●View more in app5 years ago
hash.sha1●●●●●●●●●●●●View more in app5 years ago
hash.sha256●●●●●●●●●●●●View more in app5 years ago
hash.sha256●●●●●●●●●●●●View more in app5 years ago
hash.md5●●●●●●●●●●●●View more in app5 years ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.