N3TWoRM

N3TWoRM is a ransomware persona linked to the Iranian Agrius cluster that emerged in April 2021 during a wave of cyberattacks against Israeli organizations. Rather than seeking financial ransom, the group used ransomware as a disruptive tool consistent with Iranian state-aligned objectives. Researchers noted connections to the 2020 Pay2Key attacks and assessed that N3TWoRM's campaigns may have been coordinated with concurrent Agrius wiper activity as part of a broader Iranian strategy targeting Israel. Activity attributed to this persona was short-lived, with operations concentrated between April and July 2021.