Agrius Deploys Moneybird in Targeted Attacks Against Israeli Organizations

Key Points

• Agrius continues to operate against Israeli targets, masking destructive influence operations as ransomware attacks.


• In recent attacks the group deployed Moneybird, a previously unseen ransomware written in C++.


• Despite presenting themselves as a new group with the name– Moneybird, this is yet another Agrius alias.


• The data was eventually leaked through one of Agrius previous aliases.


• As demonstrated in the Moneybird attacks, Agrius’s techniques, tactics and procedures (TTP) remain largely unchanged.

Introduction

While responding to a ransomware attack …

agrius alias attacks data influence influence operations israeli key key points masking name operations organizations ransomware ransomware attacks targeted attacks