Fantasy
Fantasy is a destructive wiper malware associated with the Iran-aligned threat actor Agrius. Reporting cited in the content states that Agrius deployed Fantasy in a 2022 supply-chain attack by compromising a trusted third-party Israeli software developer, affecting downstream victims across multiple sectors and beyond Israel. The content also states that Agrius used Fantasy alongside Apostle after exploiting publicly available one-day vulnerabilities in public-facing web applications and deploying web shells. In separate reporting, Stairwell identified a payload named Fantasy as one of two deployment mechanisms for the Goldbackdoor malware used in an APT37 campaign targeting journalists covering North Korea; in that context, Fantasy was a shellcode payload retrieved from Microsoft OneDrive and both deployment mechanisms relied on stealthy process injection. Because the provided content uses the same name for both an Agrius wiper and an APT37 Goldbackdoor deployment payload, the naming appears overloaded. High-confidence details directly stated in the content are that Fantasy has been described as a wiper used by Agrius in a supply-chain attack, and separately as a shellcode payload/deployment mechanism for Goldbackdoor in an APT37 espionage campaign.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This payload is called “Fantasy,” and according to Stairwell, it’s the first of the two deploying mechanisms of Goldbackdoor, both relying on stealthy process injection.
Supply chain exploitation: The deployment of the Fantasy wiper represented a significant escalation in Agrius’s targeting methodology. By compromising a trusted third-party Israeli software developer, the threat actors executed a supply-chain attack that impacted downstream victims across multiple global verticals.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
The second script downloads and executes a shellcode payload stored on Microsoft OneDrive, a legitimate cloud-based file hosting service... The malware utilizes legitimate cloud services for the exfiltration of files, with Stairwell noticing the abuse of both Google Drive and Microsoft OneDrive.
Execution
4 techniques
Execution
Upon execution, a PowerShell script launches... The second script downloads and executes a shellcode payload stored on Microsoft OneDrive
Upon execution, a PowerShell script launches and opens a decoy document (doc) for distraction while decoding a second script in the background.
Persistence
2 techniques
Persistence
The second script downloads and executes a shellcode payload stored on Microsoft OneDrive, a legitimate cloud-based file hosting service... The malware utilizes legitimate cloud services for the exfiltration of files, with Stairwell noticing the abuse of both Google Drive and Microsoft OneDrive.
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A wiper used in a supply-chain attack after compromise of a trusted third-party software developer, impacting downstream victims across multiple sectors.
A destructive wiper used in a supply-chain attack to damage targets across multiple sectors beyond Israel.
A shellcode payload used as a deployment mechanism for Goldbackdoor, downloaded from Microsoft OneDrive and executed via stealthy process injection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.