Loading story…
SentinelLabs reported that suspected Iranian threat actor Agrius likely carried out a targeted ransomware attack against Israel’s Bar-Ilan University using a new version of its custom Apostle malware. Researchers linked the incident to an Apostle sample compiled on the same day as the attack and said the ransom note matched the note publicly associated with the university breach, strengthening attribution to the group.
The operation used a .NET loader dubbed Jennlog, which concealed payloads inside fake log-file resources, applied anti-analysis techniques, optionally checked victim fingerprints, and then decrypted and executed malware directly in memory. SentinelLabs also identified another Jennlog variant delivering OrcusRAT, indicating Agrius was continuing to refine its tooling from earlier destructive activity toward more mature ransomware-capable operations while retaining sabotage-oriented tradecraft.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
SentinelLabs published research attributing the Bar-Ilan University incident to Agrius and detailing the use of Jennlog and Apostle. The report also noted another Jennlog variant used to load OrcusRAT, indicating continued evolution of the group’s tooling.
Researchers linked the Bar-Ilan incident to an Apostle sample compiled on August 15, 2021, the same day as the attack. The attack chain used a .NET loader dubbed Jennlog to decrypt and execute the embedded malware in memory.
SentinelLabs reported that a suspected Iranian threat actor, Agrius, likely conducted a ransomware attack against Israel’s Bar-Ilan University using a new version of its custom Apostle ransomware. The ransom note matched the note publicly associated with the incident.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026
The **BlackMagic** ransomware group targeted transportation and logistics organizations in Israel, publicly naming more than ten victims and claiming to have stolen roughly **50GB** of data. Researchers said the operation combined encryption with **double extortion**, but unlike typical ransomware campaigns, the group reportedly omitted payment instructions from its ransom note and instead advertised stolen data on social media and cybercrime forums. The leaked material was described as sensitive transportation-sector information that could affect more than **65% of Israeli citizens**, and investigators said the campaign showed signs of both disruptive and financially motivated activity. Technical analysis found BlackMagic used malware aligned with **MITRE ATT&CK `T1486` (Data Encrypted for Impact)**. The payload was a **64-bit DLL** launched through `rundll32.exe`, used repeated sleep calls to evade sandboxing, terminated numerous processes, disabled Task Manager, contacted **`5.230.70.49`**, encrypted files with the **Rijndael** algorithm, and appended the **`.BlackMagic`** extension. It also dropped a batch file to change the desktop wallpaper, force a reboot, and remove traces, while researchers noted similarities to earlier anti-Israel disruptive ransomware activity, including **Moses Staff**.
Aug 15, 2026
ESET reported that the Iran-aligned **Agrius** threat group deployed a previously undocumented wiper dubbed **Fantasy** through a software supply-chain compromise. The operation abused a legitimate Israeli software distributor’s update mechanism to deliver malware to downstream targets, allowing the attackers to masquerade as trusted software and gain access inside victim environments before launching destructive activity. According to ESET’s findings, **Fantasy** was designed to wipe systems while presenting itself as ransomware, continuing Agrius’s pattern of disruptive attacks that blend espionage-style intrusion with destructive payloads. The campaign targeted organizations in Israel, and the use of a compromised supplier highlighted how trusted third-party software channels can be weaponized to bypass defenses and spread malware deeper into enterprise networks.
Jul 12, 2026