Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.12 Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).3
- SentinelOne Agrius 2021
- CheckPoint Agrius 2023
- Microsoft Iran Cyber 2023
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Agrius | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Pink Sandstorm | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | AMERICIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Agonizing Serpens | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BlackShadow | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1005 | Data from Local System | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1036 | Masquerading | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1046 | Network Service Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1074.001 | Local Data Staging | — |
| T1078.002 | Domain Accounts | — |
| T1110 | Brute Force | — |
| T1110.003 | Password Spraying | — |
| T1119 | Automated Collection | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1505.003 | Web Shell | — |
| T1543.003 | Windows Service | — |
| T1560.001 | Archive via Utility | — |
| T1570 | Lateral Tool Transfer | — |
| T1583 | Acquire Infrastructure | — |
| T1685 | Disable or Modify Tools | — |
Aliases
Agonizing Serpens · Agrius · AMERICIUM · BlackShadow · Pink Sandstorm
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.