FlagThis

← All Threat Actors
Threat Actor Profile

Agrius

Agonizing Serpens AMERICIUM BlackShadow Cobalt Shadow DarkRypt Deadwood DEV-0227 G1030 Justice Blade Pink Sandstorm SharpBoys
▲ High Threat
[Agrius](https://attack.mitre.org/groups/G1030) is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.(Citation: SentinelOne Agrius 2021)(Citation: CheckPoint Agrius 2023) Public reporting has linked [Agrius](https://attack.mitre.org/groups/G1030) to Iran's Ministry of Intelligence and Security (MOIS).(Citation: Microsoft Iran Cyber 2023)
Origin —

Known TTPs

Remote System Discovery
Disable or Modify Tools
Network Service Discovery
Domain Accounts
Deobfuscate/Decode Files or Information
Web Shell
Data from Local System
Acquire Infrastructure
Local Data Staging
Password Spraying
Automated Collection
Security Account Manager
Archive via Utility
Masquerading
LSASS Memory
Remote Desktop Protocol
Exploit Public-Facing Application
Brute Force
Windows Command Shell
Windows Service
Exfiltration Over C2 Channel
Lateral Tool Transfer

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD