![Dark Reading Global Logo Dark Reading Global Logo](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc8a6395802cafad0/654e0d60123f32040a075bab/Dark_Reading_Logo_Global_k.png?width=700&auto=webp&quality=80&disable=upscale)
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa.
Iran-Linked Agrius APT Group Targets Israeli Education, Tech Sectors
The attackers also use custom wipers to cover their tracks and bypass EDR.
November 7, 2023
![Israeli and Iranian flags painted on a wall Israeli and Iranian flags painted on a wall](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt55e585c946f4455a/654e399d2317b9040ab713a4/israel_iran_wall_Zoonar_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
A series of attacks has targeted the Israeli higher education and technology sectors throughout this year, stealing personal information and disabling endpoints.
Research by Palo Alto Networks' Unit 42 found the attackers — which it identified as the advanced persistent threat (APT) Agonizing Serpens (aka Agrius, BlackShadow, Pink Sandstorm, and DEV-0022), linked to Iran — were able to exploit Internet-facing Web servers, and deploy multiple Web shells into their targets in order to get a foothold in a network.
Typical attacks from Agonizing Serpens involve stealing sensitive information that includes PII and intellectual property, which is then published on social media or Telegram channels "to sow fear or inflict reputational damage." In the recent string of Israeli attacks, the group stole ID numbers, passport scans, and email and postal addresses.
The researchers from Unit 42 did not specifically name any of the targets, but confirmed that only Israeli organizations were affected by the attacks.
The attackers also use custom wipers to render endpoints unusable and to cover their tracks. This tactic was first detected in attacks conducted in 2021; it has resurfaced as the attackers place an emphasis on stealth and evasive techniques to bypass security solutions such as endpoint detection and response (EDR).
Read more about:
DR Global Middle East & AfricaAbout the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024