Loading story…
ESET reported that the Iran-aligned Agrius threat group deployed a previously undocumented wiper dubbed Fantasy through a software supply-chain compromise. The operation abused a legitimate Israeli software distributor’s update mechanism to deliver malware to downstream targets, allowing the attackers to masquerade as trusted software and gain access inside victim environments before launching destructive activity.
According to ESET’s findings, Fantasy was designed to wipe systems while presenting itself as ransomware, continuing Agrius’s pattern of disruptive attacks that blend espionage-style intrusion with destructive payloads. The campaign targeted organizations in Israel, and the use of a compromised supplier highlighted how trusted third-party software channels can be weaponized to bypass defenses and spread malware deeper into enterprise networks.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
ESET published research detailing the new Fantasy wiper and attributing the supply-chain attack to Agrius, describing the malware and the intrusion chain used to target Israeli organizations.
After compromising the supplier, Agrius delivered a new wiper dubbed Fantasy to selected victims through a software update mechanism. The malware was used in attacks against organizations in Israel.
ESET reported that the Iran-aligned Agrius group breached an Israeli software company as part of a supply-chain operation, using the supplier's software distribution channel to reach downstream targets.
SentinelLabs published research on Agrius describing the group's evolution from destructive wiper attacks to ransomware-style operations. The report documented an earlier phase of Agrius activity that predates the later Fantasy supply-chain campaign in Israel.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcesentinelone.com
Open sourceeset.com
Open sourcecommunity.riskiq.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported sustained global activity by China-, Iran-, North Korea-, and Russia-aligned threat actors across Q4 2025 and Q1 2026, with operations closely tied to geopolitical priorities. China-aligned groups targeted government, maritime, energy, and technology organizations in countries including Venezuela, Syria, Cambodia, Panama, and South Korea, and also abused **Ivanti VPN** environments. Iran-linked activity shifted during the late-February 2026 war in Iran: established APT operations declined, while proxy, hacktivist, and unattributed actors increased attacks against Israel and other perceived adversaries, including the use of destructive tooling described as a bootkit-style wiper. North Korea-aligned actors continued social-engineering and supply-chain campaigns aimed at developers and cryptocurrency ecosystems, including a Lazarus-linked compromise of the **`axios`** JavaScript library, while **Andariel** resurfaced in South Korea using **TigerRAT** and attempting ransomware deployment. Russia-aligned groups remained heavily focused on Ukraine, with **Sednit** targeting military and drone-related entities and **Sandworm** escalating destructive operations, including a December 2025 incident at a Polish energy company attributed with medium confidence. ESET also documented browser-in-the-browser phishing against a Japanese think tank, **Asin** Android spyware targeting Arabic-speaking users, and the compromise of a UAE defense company through a **SmartOffice CRM** server.
Jun 29, 2026
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026