Threat actor · G1030

Agrius

Also known as Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow.

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets. Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).

ATT&CK techniques

22 mapped

T1003.001 T1003.002 T1005 T1018 T1021.001 T1036 T1041 T1046 T1059.003 T1074.001 T1078.002 T1110 T1110.003 T1119 T1140 T1190 T1505.003 T1543.003 T1560.001 T1570 T1583 T1685