Agonizing Serpens

Agonizing Serpens is the name assigned by Palo Alto Networks Unit 42 to an Iranian-linked threat actor widely known as Agrius. The group has been active since 2020 and is recognized for combining data theft with destructive wiper attacks against Israeli organizations, particularly in the technology and higher education sectors. In campaigns documented through 2023, the actor stole personally identifiable information and intellectual property before deploying novel wipers — including BFG Agonizer, MultiLayer, and PartialWasher — to destroy endpoints and cover its tracks. The group actively invests in bypassing endpoint detection and response tools.