Agrius
- ID
- G1030
- Associated names
- Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.[1][2] Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).[3]
Techniques used (22)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1005 Data from Local System
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1036 Masquerading
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1059.003 Windows Command Shell
- T1074.001 Local Data Staging
- T1078.002 Domain Accounts
- T1110 Brute Force
- T1110.003 Password Spraying
- T1119 Automated Collection
- T1140 Deobfuscate/Decode Files or Information
- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1543.003 Windows Service
- T1560.001 Archive via Utility
- T1570 Lateral Tool Transfer
- T1583 Acquire Infrastructure
- T1685 Disable or Modify Tools
Software used (9)
- S0002 Mimikatz
- S0073 ASPXSpy
- S0590 NBTscan
- S1132 IPsec Helper
- S1133 Apostle
- S1134 DEADWOOD
- S1135 MultiLayer Wiper
- S1136 BFG Agonizer
- S1137 Moneybird