Sorority Row

After finding out that her boyfriend Garrett (Matt O'Leary) has cheated on her, Theta Pi sorority sister Megan (Audrina Patridge) enlists the help of her friends and fellow sorority sisters Cassidy (Briana Evigan), Jessica (Leah Pipes), Ellie (Rumer Willis), Claire (Jamie Chung), and Garrett's sister Chugs (Margo Harshman) to pull a prank on him. After Megan fakes her own death while having sex with him, Garrett and the girls bring her to a lake, where they intend to dump her body. When Jessica mentions they need to release the air out of her lungs so her body will not float to the surface, Garrett stabs Megan in the chest with a tire iron, killing her for real. Realizing what they've done, the group dump Megan's body and the tire iron in a nearby mine shaft. Everyone swears to never mention the incident to anyone, much to Cassidy and Ellie's dismay.
A year later, the girls are graduating from Rosman University and have put the incident behind them, but Cassidy has grown apart from the rest of the group. During the party held after graduation, the girls all receive on their cell phones a photo of a robed person holding the bloody tire iron. Suspicion immediately falls on Garrett, but Chugs insists he's changed after killing Megan. Maggie (Caroline D'Amore), Megan's younger sister, arrives, wanting to honor her sister's memory by attending the party. Later, Chugs leaves to go to an appointment to visit her therapist. However, upon arriving for her appointment, an unknown figure also arrives and kills both Chugs and her therapist.
Later that day, in the sorority's shower room, Claire and Jessica talk about the night Megan was murdered. After they leave, a sorority girl named Joanna, who overheard their conversation, is murdered. At the party that night, Claire's ex-boyfriend Mickey is attacked and murdered by the killer, which Ellie witnesses while hiding. Cassidy, Claire, Jessica, and Ellie regroup and all receive a text containing the video of Megan's death and a message telling them to go to the mine shaft in twenty minutes or the video will be sent to the police. The girls drive to the mine shaft, and encounter Garrett, who has cut his wrists and begins threatening them.
Thinking Garrett is the one stalking them, Jessica runs over him with her vehicle. However, they discover afterward that Garrett has been receiving the same text messages they have. Ellie suspects that Megan is the killer, believing that she did not actually die and is seeking revenge. To prove that Megan is dead, the girls lower Cassidy down the shaft to check, but instead of finding Megan's body, she finds a message written in blood which reads, "Theta Pi must die". Back at the now empty sorority house, the girls receive a text from Chugs' cell phone, telling them that she is dead. Afterward, Claire is murdered with a flare gun. Searching the house for Jessica's boyfriend, Kyle (Matt Lanter), the girls run into Maggie and their house mother, Mrs. Crenshaw (Carrie Fisher).
After finding out about Megan's murder, Mrs. Crenshaw tells the girls to lock themselves in Jessica's bedroom and to call the police while she searches for the killer. Maggie is horrified when she learns what happened to Megan and, thinking she's the killer, leaves the room to find her and convince her to stop killing. After many failed attempts to shoot the killer in the kitchen, Mrs. Crenshaw attempts to reload her shotgun but is killed by the hooded figure. With no cell phones around, Cassidy and Jessica decide to find Mickey's body and use his cell, telling Ellie to run if she gets the chance. Downstairs, the killer confronts Maggie and after she begs the killer to stop, throws a Molotov cocktail at her, setting the house on fire. Cassidy and Jessica run into Kyle, who injures Jessica after getting into an argument with her. Cassidy and Jessica flee to an under-renovation bathroom where they find Megan's decomposing corpse hanging in a closet.
Kyle finds and attacks them, but is killed with an axe by Andy (Julian Morris), Cassidy's boyfriend. A confused Cassidy realizes that he's the killer after spotting a tire iron on his belt. Jessica regains consciousness and tries to negotiate with Andy, but Andy fatally stabs her. Andy reveals he had hoped for a bright future with Cassidy, but because she was involved with Megan's murder, he feared that she would be found out, so he decided to kill everyone who knew about it. Despite Cassidy's opposition, Andy tells her that they need to kill Ellie, the only other person who knows about Megan's murder. Andy reveals that she was the one who confided in him about Megan's murder and will likely report it the police. Cassidy plays along and tells Andy that Ellie is in the basement
Just as Cassidy fetches Ellie from upstairs, they're discovered and attacked by Andy. Cassidy stuns Andy and escapes, but finds Maggie, who is trapped behind the flames. Andy attempts to kill Maggie, resulting in a fight between him and Cassidy. The floor then crumbles underneath Cassidy, and she is left hanging over the burning basement. As Andy recovers and is about to finish her off, Ellie appears and shoots him with Mrs. Crenshaw's shotgun. He falls backward onto the burning floor, which collapses under him and he falls to his death into the flames. After Maggie and Ellie save Cassidy, the three girls escape from the burning sorority house just as the fire department and other emergency personnel arrive.
Months later, the Theta Pi building is being renovated from the fire and Maggie is now a Theta Pi sister. As the girls sing the Theta Pi song, a man comes into view, holding a garden trowel. The camera pans up to his wrist, revealing scars, implying that Garrett is still alive.

Question: Who attacks Cassidy and Ellie?
Answer: Andy