H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

MultiLayer Wiper

[MultiLayer Wiper](https://attack.mitre.org/software/S1135) is wiper malware written in .NET associated with [Agrius](https://attack.mitre.org/groups/G1030) operations. Observed samples of [MultiLayer Wiper](https://attack.mitre.org/software/S1135) have an anomalous, future compilation date suggesting possible metadata manipulation.(Citation: Unit42 Agrius 2023)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[MultiLayer Wiper](https://attack.mitre.org/software/S1135) is wiper malware written in .NET associated with [Agrius](https://attack.mitre.org/groups/G1030) operations. Observed samples of [MultiLayer Wiper](https://attack.mitre.org/software/S1135) have an anomalous, future compilation date suggesting possible metadata manipulation.(Citation: Unit42 Agrius 2023)

Labels

malware
15 recorded

Relationships

uses
from Agrius
Group
uses
to Clear Windows Event Logs
Technique
uses
to Data Destruction
Technique
uses
to Disable or Modify Tools
Technique
uses
to Disk Structure Wipe
Technique
uses
to Embedded Payloads
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Indicator Removal
Technique
uses
to Inhibit System Recovery
Technique
uses
to Scheduled Task
Technique
uses
to Stored Data Manipulation
Technique
uses
to System Shutdown/Reboot
Technique
uses
to Timestomp
Technique
uses
to Windows Command Shell
Technique
2 external

References

mitre-attack
S1135
open
Unit42 Agrius 2023
https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance