- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Agency named
- MOIS, Ministry of Intelligence
- Motivation
- Information theft and espionage; Sabotage and destruction
- Seen
- 2020–2026
- Status
- Active
- ATT&CK
- G1030 · 22 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0108 · agrius
IranWhat it is
Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets. Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Spectral Kitten
- Mandiant
- UNC2428
- Microsoft
- Pink Sandstorm, DEV-0022, DEV-0227
- Other names
- Agonizing Serpens, AMERICIUM, Black Shadow, BlackShadow, Deadwood, FireAnt, Justice Blade, SharpBoys
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- MicrosoftIran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Hong Kong, Israel, South Africa
Tools
The tools and malware families the sources tie to it.
- ASPXSpy
- Apostle
- BFG Agonizer
- DEADWOOD
- IPsec Helper
- Mimikatz
- Moneybird
- MultiLayer Wiper
- NBTscan
- Wiper
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de