H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Apostle](https://attack.mitre.org/software/S1133) is malware that has functioned as both a wiper and, in more recent versions, as ransomware. [Apostle](https://attack.mitre.org/software/S1133) is written in .NET and shares various programming and functional overlaps with [IPsec Helper](https://attack.mitre.org/software/S1132).(Citation: SentinelOne Agrius 2021)

Labels

malware
11 recorded

Relationships

uses
from Agrius
Group
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
2 external

References

mitre-attack
S1133
open
SentinelOne Agrius 2021
https://assets.sentinelone.com/sentinellabs/evol-agrius
open