Diamond software delivered Fantasy wiper

Agrius used a software supply chain to turn a specialized business tool into a timed wiper delivery path. ESET did not name the Israeli developer, but said all observed victims were customers of its software suite, which served the diamond industry.

The campaign started with preparation. On February 20, 2022, Agrius deployed credential-harvesting tools at a South African diamond-industry organization. On March 12, it launched the destructive phase. Victims in South Africa, Israel, and Hong Kong executed Fantasy within about two and a half hours.

Fantasy was built from the Apostle code base but no longer pretended to be ransomware. It overwrote files, deleted them, damaged registry associations, cleared event logs, attempted to wipe fixed drives and the Windows system drive, overwrote the MBR, then rebooted the machine. Recovery was sometimes possible, but the intent was destruction.

Sandals handled lateral execution. It used SMB and PsExec with harvested credentials to write batch files and launch Fantasy on remote systems. ESET's supply-chain assessment rests on the shared software vendor, the update-like naming, the synchronized execution window, and the wiper's location under the Windows temp path used by the legitimate update flow.