Iranian Agonizing Serpens APT is targeting Israeli entities with destructive cyber attacks

Iran-linked Agonizing Serpens group has been targeting Israeli organizations with destructive cyber attacks since January.

Iran-linked Agonizing Serpens group (aka Agrius, BlackShadow, Pink Sandstorm, DEV-0022) has been targeting Israeli organizations in higher education and tech sectors with destructive cyber attacks since January 2023.

Palo Alto Networks’ s Unit 42 researchers reported that threat actors first attempt to steal sensitive data (i.e. personally identifiable information (PII) and intellectual property) and then deploy various wipers to cover the tracks.

The researchers observed the Unit 42 researchers using three previously unknown wipers named MultiLayer, PartialWasher, and a custom tool named Sqlextractor used to extract information from database servers.

The tool sqlextractor (binary name sql.net4.exe) allows threat actors to query SQL databases and extract sensitive PII data, such as ID numbers, Passport scans, Emails, and Full addresses.

Agonizing Serpens has been active since December 2020, it is known for its destructive wiper and fake-ransomware attacks against Israeli organizations.

Threat actors initially gained access to the target infrastructure by exploiting known vulnerabilities in internet-facing web servers. Then the attackers deployed multiple web shells to gain a foothold in the network.

“The web shells that threat actors used in the described attack contain the same code as web shells that were observed in previous Agonizing Serpens attacks, with variations to the naming of functions. The web shells appear to be variations of ASPXSpy.” reads the report published by Unit 42.

Shortly after the threat actors deployed the web shells, they started carrying out reconnaissance using various known and publicly available scanners to map out the network and steal credentials of users with administrative privileges.

The attackers attempted to exfiltrate the information from the victims by using different publicly available tools, including WinSCP and Putty

“This attack is a part of a broader offensive campaign that targets Israeli organizations. Based on our telemetry, the most targeted organizations belong to the education and technology sectors.” concludes the report that also includes indicators of compromise (IoCs). “Our investigation uncovered new tools in the group’s arsenal that include a set of three previously undocumented wipers, as well as a database extractor tool. Analysis of the new wipers revealed that the group has upgraded their capabilities, putting an emphasis on stealth and evasive techniques designed to bypass security solutions such as EDR technology.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Agonizing Serpens)