A new attack group called Agrius is launching damaging wiper attacks against Pakistani targets, which researchers said are hiding behind ransomware to make their state-sponsored activities appear financially motivated.
The Agrius Advanced Persistent Threat (APT) appears to use both public and private malware families to aid their attacks. Recent research made by Rewterz Threat Intel shows that they have been planting the open-source ASPXSpy Malware on compromised networks, but they have also relied on a previously unidentified ransomware/wiper called Apostle.
Apostle,was initially deployed in an attempt to wipe data but failed to do so, likely because of a logic flaw in its code. The internal name its developers gave it was “wiper-action.” In a later version, the bug was fixed and the malware gained full-fledged ransomware behaviors, including the ability to leave notes demanding that victims pay a ransom in exchange for a decryption key.
The Apostle Malware is a custom-built malware threat that also uses webshells so that attackers can move laterally inside a compromised network. To conceal their IP addresses, members use the ProtonVPN (Ehrlich, 2021).
Ehrlich, A., 2021. From Wiper to Ransomware | The Evolution of Agrius. [online] SentinelLabs. Available at: <https://labs.sentinelone.com/from-wiper-to-ransomware-the-evolution-of-agrius/>.