Threat intelligence / Malware

IPsec Helper

[IPsec Helper](https://attack.mitre.org/software/S1132) is a post-exploitation remote access tool linked to [Agrius](https://attack.mitre.org/groups/G1030) operations. This malware shares significant programming and functional overlaps with [Apostle](https://attack.mitre.org/software/S1133) ransomware, also linked to [Agrius](https://attack.mitre.org/groups/G1030). [IPsec Helper](https://attack.mitre.org/software/S1132) provides basic remote access tool functionality such as uploading files from victim systems, running commands, and deploying additional payloads.(Citation: SentinelOne Agrius 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[IPsec Helper](https://attack.mitre.org/software/S1132) is a post-exploitation remote access tool linked to [Agrius](https://attack.mitre.org/groups/G1030) operations. This malware shares significant programming and functional overlaps with [Apostle](https://attack.mitre.org/software/S1133) ransomware, also linked to [Agrius](https://attack.mitre.org/groups/G1030). [IPsec Helper](https://attack.mitre.org/software/S1132) provides basic remote access tool functionality such as uploading files from victim systems, running commands, and deploying additional payloads.(Citation: SentinelOne Agrius 2021)

Labels

malware

16 recorded

Relationships

uses

Group

uses

to Clear Persistence

Technique

uses

to Data from Local System

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File Deletion

Technique

uses

to Indicator Removal

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Service Execution

Technique

uses

to Time Based Checks

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

S1132

SentinelOne Agrius 2021

https://assets.sentinelone.com/sentinellabs/evol-agrius