Agrius

Threat Actors · Agrius

· ATT&CK GroupG1030

Pink SandstormAMERICIUMAgonizing SerpensBlackShadow

Techniques

Software

Tactics

Aliases

Description

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.(Citation: SentinelOne Agrius 2021)(Citation: CheckPoint Agrius 2023) Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).(Citation: Microsoft Iran Cyber 2023)

Tactic Coverage

credential access (4)collection (4)stealth (3)persistence (3)discovery (2)lateral movement (2)privilege escalation (2)initial access (2)exfiltration (1)execution (1)resource development (1)defense impairment (1)

Techniques Used (22)

T1003.001LSASS Memory

credential access

T1003.002Security Account Manager

credential access

T1005Data from Local System

collection

T1018Remote System Discovery

discovery

T1021.001Remote Desktop Protocol

lateral movement

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 22 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (9)

S0073ASPXSpymalware S1133Apostlemalware S1136BFG Agonizermalware S1134DEADWOODmalware S1132IPsec Helpermalware S0002Mimikatztool S1137Moneybirdmalware S1135MultiLayer Wiper

References (10)

https://attack.mitre.org/groups/G1030 https://assets.sentinelone.com/sentinellabs/evol-agrius https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-israeli-organizations/https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/05/Iran-turning-to-cyber-enabled-influence-operations-for-greater-effect-05022023.pdf https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/