Loading malware…
MultiLayer is a modular destructive wiper associated with Iranian state-aligned activity. It has been linked to deployments against Israeli educational and technology organizations and to operations involving Agonizing Serpens (Agrius) and Boggy Serpens (MuddyWater). Operators have used legitimate remote monitoring and management tools to distribute MultiLayer payloads at scale. Its documented role is data-destructive activity rather than ransomware or espionage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The content contrasts Screening Serpens with Agonizing Serpens, stating that the latter used the wiper malware MultiLayer and PartialWasher against Israeli educational and technology organizations.
MultiLayer and BFG Agonizer: Concurrently, collaborative deployments between Agonizing Serpens and Boggy Serpens (aka MuddyWater) introduced highly modular wipers like MultiLayer and BFG Agonizer. These operations frequently abused legitimate remote monitoring and management (RMM) tools to distribute the payloads at scale.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Wiper malware attributed in the content to Agonizing Serpens activity against Israeli organizations.
Mentioned as a wiper targeting Israel.
A highly modular wiper distributed at scale via abused legitimate RMM tools in collaborative destructive operations.
Destructive wiper malware family referenced as part of Iran-aligned wiper tooling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.