MultiLayer
MultiLayer is a highly modular wiper malware family referenced as part of Iran’s destructive malware arsenal. The provided content associates MultiLayer with collaborative operations between Agonizing Serpens (Agrius) and Boggy Serpens (MuddyWater). It states that these actors deployed MultiLayer alongside BFG Agonizer in concurrent campaigns and frequently abused legitimate remote monitoring and management (RMM) tools to distribute the payloads at scale. The malware is described in the context of Iranian state-aligned disruptive operations that have targeted organizations for destructive impact, particularly as part of a broader evolution from overt custom wipers toward combinations of modular destructive payloads and abuse of legitimate enterprise administration platforms. The content explicitly identifies MultiLayer as one of more than 15 Iranian wiper families. No specific indicators of compromise, file hashes, or detailed technical internals for MultiLayer are provided in the source content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MultiLayer and BFG Agonizer: Concurrently, collaborative deployments between Agonizing Serpens and Boggy Serpens (aka MuddyWater) introduced highly modular wipers like MultiLayer and BFG Agonizer. These operations frequently abused legitimate remote monitoring and management (RMM) tools to distribute the payloads at scale.
MultiLayer and BFG Agonizer: Concurrently, collaborative deployments between Agonizing Serpens and Boggy Serpens (aka MuddyWater) introduced highly modular wipers like MultiLayer and BFG Agonizer. These operations frequently abused legitimate remote monitoring and management (RMM) tools to distribute the payloads at scale.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Command and Control
1 technique
Command and Control
Exfiltration
1 technique
Exfiltration
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A highly modular wiper distributed at scale via abused legitimate RMM tools in collaborative destructive operations.
Destructive wiper malware family referenced as part of Iran-aligned wiper tooling.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.