S1133: Apostle

Apostle is malware that has functioned as both a wiper and, in more recent versions, as ransomware. Apostle is written in .NET and shares various programming and functional overlaps with IPsec Helper.[1]

EnterpriseS1133MalwareObject v1.0ModifiedAug 29, 2024, 15:21 UTC (UTC+00:00)

S1133: Apostle describes [Apostle](https://attack.mitre.org/software/S1133) is malware that has functioned as both a wiper and, in more recent versions, as ransomware. [Apostle](https://attack.mitre.org/software/S1133) is written in .NET and shares various programming and functional overlaps with [IPsec Helper](https://attack.mitre.org/software/S1132).(Citation: SentinelOne Agrius 2021)

Executive priority

S1133: Apostle is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1133: Apostle by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S1133: Apostle appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Apostle

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques10 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1685.005	Clear Windows Event LogsSub-technique	Apostle will attempt to delete all event logs on a victim machine following file wipe activity.[1]
Enterprise	T1057	Process Discovery	Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.[1]
Enterprise	T1529	System Shutdown/Reboot	Apostle reboots the victim machine following wiping and related activity.[1]
Enterprise	T1480	Execution Guardrails	Apostle's ransomware variant requires that a base64-encoded argument is passed when executed, that is used as the Public Key for subsequent encryption operations. If Apostle is executed without this argument, it automatically runs a self-delete function.[1]
Enterprise	T1053.005	Scheduled TaskSub-technique	Apostle achieves persistence by creating a scheduled task, such as `MicrosoftCrashHandlerUAC`.[1]
Enterprise	T1561.001	Disk Content WipeSub-technique	Apostle searches for files on available drives based on a list of extensions hard-coded into the sample for follow-on wipe activity.[1]
Enterprise	T1486	Data Encrypted for Impact	Apostle creates new, encrypted versions of files then deletes the originals, with the new filenames consisting of a random GUID and ".lock" for an extension.[1]
Enterprise	T1485	Data Destruction	Apostle initially masqueraded as ransomware but actual functionality is a data destruction tool, supported by an internal name linked to an early version, `wiper-action`. Apostle writes random data to original files after an encrypted copy is created, along with resizing the original file to zero and changing time property metadata before finally deleting the original file.[1]
Enterprise	T1070.004	File DeletionSub-technique	Apostle writes batch scripts to disk, such as `system.bat` and `remover.bat`, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.[1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.[1]

Associated objects

Groups, software, and campaigns

G1030: Agrius

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.[1][2] Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).[3]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.0
Created: May 22, 2024, 19:16 UTC (UTC+00:00)
Modified: Aug 29, 2024, 15:21 UTC (UTC+00:00)
Raw hash: c6a298f3246072d7...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.0	Aug 29, 2024, 15:21 UTC (UTC+00:00)	Current bundle	`c6a298f32460…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Aug 29, 2024, 15:21 UTC (UTC+00:00)	Older bundle	`c6a298f32460…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
SentinelOne Agrius 2021
Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
Open source URL
[2]
mitre-attackS1133
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use