MITRE ATT&CKgroup

G1030 Agrius

Published 2024-05-21 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow
Version
1.0
Created
2024-05-21

Description

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets. Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).

Related

Uses · MITRE ATT&CK (31)

  • T1685 Disable or Modify Tools technique
  • S1132 IPsec Helper software (malware)
  • S1133 Apostle software (malware)
  • S1134 DEADWOOD software (malware)
  • S1135 MultiLayer Wiper software (malware)
  • S1136 BFG Agonizer software (malware)
  • S1137 Moneybird software (malware)
  • S0590 NBTscan software (tool)
  • T1583 Acquire Infrastructure technique
  • T1074.001 Local Data Staging sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1059.003 Windows Command Shell sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1543.003 Windows Service sub-technique
  • T1505.003 Web Shell sub-technique
  • T1190 Exploit Public-Facing Application technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • S0002 Mimikatz software (tool)
  • S0073 ASPXSpy software (malware)
  • T1005 Data from Local System technique
  • T1018 Remote System Discovery technique
  • T1036 Masquerading technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1046 Network Service Discovery technique
  • T1110 Brute Force technique
Show all 31 ›

References