Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.12 Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).3
- SentinelOne Agrius 2021
- CheckPoint Agrius 2023
- Microsoft Iran Cyber 2023
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1018 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2024 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1005 | Data from Local System | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1036 | Masquerading | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1046 | Network Service Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1074.001 | Local Data Staging | — |
| T1078.002 | Domain Accounts | — |
| T1110 | Brute Force | — |
| T1110.003 | Password Spraying | — |
| T1119 | Automated Collection | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1505.003 | Web Shell | — |
| T1543.003 | Windows Service | — |
| T1560.001 | Archive via Utility | — |
| T1570 | Lateral Tool Transfer | — |
| T1583 | Acquire Infrastructure | — |
| T1685 | Disable or Modify Tools | — |
别名
Agonizing Serpens · Agrius · AMERICIUM · BlackShadow · Pink Sandstorm
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。