Loading malware…
MultiLayer is a modular destructive malware family associated with Iranian state-aligned cyber operations, particularly activity linked to Agonizing Serpens (Agrius) and reported collaboration with Boggy Serpens (MuddyWater). It is part of a broader Iranian wiper arsenal used in disruptive campaigns targeting Israeli organizations and regional adversaries. MultiLayer has been described alongside other destructive families such as BFG Agonizer and PartialWasher in operations intended to impair victim environments rather than monetize access.
The malware is characterized as a wiper designed for destructive impact. Reported operations involving MultiLayer emphasized scalable deployment through abuse of legitimate remote monitoring and management tooling, indicating an operational model in which attackers first obtain administrative access and then distribute the payload broadly across victim systems. This places MultiLayer within a phase of Iranian intrusion activity that increasingly combines destructive malware with living-off-the-land techniques and enterprise administration abuse to maximize reach and reduce reliance on overtly malicious delivery infrastructure.
MultiLayer has been referenced in campaigns targeting Israel and fits the pattern of Iranian retaliatory or coercive cyber activity directed at government, enterprise, and critical-sector victims in the region. High-confidence public reporting supports its role as a destructive payload, but detailed technical specifics on internal functionality, persistence, or platform-specific implementation remain limited in the available information.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MultiLayer and BFG Agonizer: Concurrently, collaborative deployments between Agonizing Serpens and Boggy Serpens (aka MuddyWater) introduced highly modular wipers like MultiLayer and BFG Agonizer. These operations frequently abused legitimate remote monitoring and management (RMM) tools to distribute the payloads at scale.
MultiLayer and BFG Agonizer: Concurrently, collaborative deployments between Agonizing Serpens and Boggy Serpens (aka MuddyWater) introduced highly modular wipers like MultiLayer and BFG Agonizer. These operations frequently abused legitimate remote monitoring and management (RMM) tools to distribute the payloads at scale.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a wiper targeting Israel.
A highly modular wiper distributed at scale via abused legitimate RMM tools in collaborative destructive operations.
Destructive wiper malware family referenced as part of Iran-aligned wiper tooling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.