Agrius
Also reported as Pink Sandstorm, AMERICIUM, BlackShadow, Agonizing Serpens, SPECTRAL KITTEN and 9 other names. Linked to Iran by four sources.
Reports per quarter
Techniques seen in the last two years
- T1005 1 report in ATT&CK
- T1007 1 report reports only
- T1008 1 report reports only
- T1010 1 report reports only
- T1012 1 report reports only
- T1016 1 report reports only
- T1016.001 1 report reports only
- T1018 1 report in ATT&CK
- T1020 1 report reports only
- T1021 1 report reports only
Show all 234 techniques Show fewer
- T1021.001 1 report in ATT&CK
- T1021.002 1 report reports only
- T1021.004 1 report reports only
- T1021.005 1 report reports only
- T1021.006 1 report reports only
- T1027 1 report reports only
- T1033 1 report reports only
- T1037 1 report reports only
- T1037.001 1 report reports only
- T1039 1 report reports only
- T1040 1 report reports only
- T1041 1 report in ATT&CK
- T1046 1 report in ATT&CK
- T1047 1 report reports only
- T1049 1 report reports only
- T1053 1 report reports only
- T1053.003 1 report reports only
- T1053.005 1 report reports only
- T1055 1 report reports only
- T1055.001 1 report reports only
- T1055.002 1 report reports only
- T1055.003 1 report reports only
- T1055.004 1 report reports only
- T1055.009 1 report reports only
- T1055.012 1 report reports only
- T1056 1 report reports only
- T1056.001 1 report reports only
- T1057 1 report reports only
- T1059 1 report reports only
- T1059.001 1 report reports only
- T1059.002 1 report reports only
- T1059.003 1 report in ATT&CK
- T1059.004 1 report reports only
- T1059.005 1 report reports only
- T1059.006 1 report reports only
- T1059.007 1 report reports only
- T1059.009 1 report reports only
- T1059.010 1 report reports only
- T1059.011 1 report reports only
- T1068 1 report reports only
- T1069 1 report reports only
- T1069.001 1 report reports only
- T1069.002 1 report reports only
- T1069.003 1 report reports only
- T1070 1 report reports only
- T1070.004 1 report reports only
- T1071 1 report reports only
- T1071.001 1 report reports only
- T1071.004 1 report reports only
- T1072 1 report reports only
- T1074 1 report reports only
- T1074.001 1 report in ATT&CK
- T1074.002 1 report reports only
- T1078 1 report reports only
- T1078.004 1 report reports only
- T1082 1 report reports only
- T1083 1 report reports only
- T1087 1 report reports only
- T1087.001 1 report reports only
- T1087.002 1 report reports only
- T1087.004 1 report reports only
- T1090 1 report reports only
- T1090.001 1 report reports only
- T1090.003 1 report reports only
- T1091 1 report reports only
- T1095 1 report reports only
- T1098 1 report reports only
- T1098.001 1 report reports only
- T1098.003 1 report reports only
- T1098.004 1 report reports only
- T1098.005 1 report reports only
- T1098.006 1 report reports only
- T1098.007 1 report reports only
- T1102 1 report reports only
- T1102.002 1 report reports only
- T1104 1 report reports only
- T1105 1 report reports only
- T1113 1 report reports only
- T1114 1 report reports only
- T1114.001 1 report reports only
- T1114.002 1 report reports only
- T1114.003 1 report reports only
- T1115 1 report reports only
- T1119 1 report in ATT&CK
- T1120 1 report reports only
- T1123 1 report reports only
- T1124 1 report reports only
- T1125 1 report reports only
- T1129 1 report reports only
- T1132 1 report reports only
- T1132.001 1 report reports only
- T1133 1 report reports only
- T1134 1 report reports only
- T1134.001 1 report reports only
- T1135 1 report reports only
- T1136 1 report reports only
- T1136.001 1 report reports only
- T1136.002 1 report reports only
- T1137 1 report reports only
- T1137.006 1 report reports only
- T1140 1 report in ATT&CK
- T1189 1 report reports only
- T1190 1 report in ATT&CK
- T1195 1 report reports only
- T1195.002 1 report reports only
- T1199 1 report reports only
- T1200 1 report reports only
- T1201 1 report reports only
- T1203 1 report reports only
- T1204 1 report reports only
- T1204.001 1 report reports only
- T1204.002 1 report reports only
- T1210 1 report reports only
- T1213 1 report reports only
- T1213.001 1 report reports only
- T1213.002 1 report reports only
- T1213.003 1 report reports only
- T1217 1 report reports only
- T1219 1 report reports only
- T1482 1 report reports only
- T1484 1 report reports only
- T1484.001 1 report reports only
- T1485 1 report reports only
- T1486 1 report reports only
- T1489 1 report reports only
- T1490 1 report reports only
- T1491.002 1 report reports only
- T1496 1 report reports only
- T1497 1 report reports only
- T1497.001 1 report reports only
- T1505 1 report reports only
- T1505.003 1 report in ATT&CK
- T1505.004 1 report reports only
- T1518 1 report reports only
- T1518.001 1 report reports only
- T1529 1 report reports only
- T1530 1 report reports only
- T1534 1 report reports only
- T1537 1 report reports only
- T1538 1 report reports only
- T1543 1 report reports only
- T1543.002 1 report reports only
- T1543.003 1 report in ATT&CK
- T1543.004 1 report reports only
- T1546 1 report reports only
- T1546.003 1 report reports only
- T1546.004 1 report reports only
- T1546.008 1 report reports only
- T1546.012 1 report reports only
- T1546.015 1 report reports only
- T1547 1 report reports only
- T1547.001 1 report reports only
- T1547.002 1 report reports only
- T1547.005 1 report reports only
- T1547.009 1 report reports only
- T1548 1 report reports only
- T1548.002 1 report reports only
- T1550 1 report reports only
- T1550.001 1 report reports only
- T1550.002 1 report reports only
- T1554 1 report reports only
- T1556 1 report reports only
- T1556.006 1 report reports only
- T1556.009 1 report reports only
- T1559 1 report reports only
- T1560 1 report reports only
- T1560.001 1 report in ATT&CK
- T1560.002 1 report reports only
- T1565 1 report reports only
- T1565.001 1 report reports only
- T1566 1 report reports only
- T1566.001 1 report reports only
- T1566.002 1 report reports only
- T1566.003 1 report reports only
- T1566.004 1 report reports only
- T1567 1 report reports only
- T1567.001 1 report reports only
- T1567.002 1 report reports only
- T1569 1 report reports only
- T1569.002 1 report reports only
- T1570 1 report in ATT&CK
- T1571 1 report reports only
- T1572 1 report reports only
- T1573 1 report reports only
- T1573.001 1 report reports only
- T1573.002 1 report reports only
- T1574 1 report reports only
- T1574.001 1 report reports only
- T1574.011 1 report reports only
- T1578 1 report reports only
- T1580 1 report reports only
- T1583 1 report in ATT&CK
- T1583.003 1 report reports only
- T1584 1 report reports only
- T1585 1 report reports only
- T1585.002 1 report reports only
- T1587 1 report reports only
- T1587.003 1 report reports only
- T1588 1 report reports only
- T1588.003 1 report reports only
- T1588.004 1 report reports only
- T1588.007 1 report reports only
- T1595 1 report reports only
- T1595.002 1 report reports only
- T1598 1 report reports only
- T1602 1 report reports only
- T1602.001 1 report reports only
- T1602.002 1 report reports only
- T1608 1 report reports only
- T1608.001 1 report reports only
- T1608.002 1 report reports only
- T1608.003 1 report reports only
- T1608.004 1 report reports only
- T1608.005 1 report reports only
- T1608.006 1 report reports only
- T1613 1 report reports only
- T1614 1 report reports only
- T1614.001 1 report reports only
- T1615 1 report reports only
- T1619 1 report reports only
- T1622 1 report reports only
- T1652 1 report reports only
- T1654 1 report reports only
- T1657 1 report reports only
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2017-0199 KEV ransomware
- CVE-2017-7921 KEV
- CVE-2018-13379 KEV ransomware
- CVE-2020-0986 KEV
- CVE-2020-10189 KEV
- CVE-2020-1380 KEV
- CVE-2020-14882 KEV
- CVE-2020-3529
- CVE-2021-1732 KEV ransomware
- CVE-2021-21972 KEV ransomware
- CVE-2021-22205 KEV ransomware
- CVE-2021-22893 KEV ransomware
Show all 40 CVEs Show fewer
- CVE-2021-26084 KEV ransomware
- CVE-2021-28310 KEV
- CVE-2021-31207 KEV ransomware
- CVE-2021-31955 KEV
- CVE-2021-31956 KEV
- CVE-2021-34473 KEV ransomware
- CVE-2021-34523 KEV ransomware
- CVE-2021-40539 KEV ransomware
- CVE-2021-440077
- CVE-2021-44228 KEV ransomware
- CVE-2021-44515 KEV
- CVE-2022-47966 KEV ransomware
- CVE-2022-47986 KEV ransomware
- CVE-2023-23397 KEV
- CVE-2023-27350 KEV ransomware
- CVE-2023-27532 KEV ransomware
- CVE-2023-46805 KEV ransomware
- CVE-2023-48788 KEV ransomware
- CVE-2023-5631 KEV
- CVE-2023-6895
- CVE-2024-0012 KEV ransomware
- CVE-2024-21413 KEV
- CVE-2024-21887 KEV ransomware
- CVE-2024-21893 KEV ransomware
- CVE-2024-21983
- CVE-2024-3400 KEV ransomware
- CVE-2024-47575 KEV
- CVE-2024-9474 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor StoneDrill (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor DistTrack (Malware Family)
-
HermeticWiper (Malware Family)
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor HermeticWiper (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor IsaacWiper (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor SystemBC (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor WhisperGate (Malware Family)
Show all 41 reports Show fewer
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor DoubleZero (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor LockBit (Malware Family)
-
Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors
-
How Microsoft names threat actors
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How Microsoft names threat actors
-
Fantasy – a new Agrius wiper deployed through a supply‑chain attack
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fantasy – a new Agrius wiper deployed through a supply‑chain attack
-
Opsec Mistakes Reveal COBALT MIRAGE Threat Actors
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Opsec Mistakes Reveal COBALT MIRAGE Threat Actors
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Report2022GTR
-
Uncovering MosesStaff techniques- Ideology over Money
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Uncovering MosesStaff techniques- Ideology over Money
-
Operation GhostShell_ Novel RAT Targets Global Aerospace and Telecoms Firms
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation GhostShell_ Novel RAT Targets Global Aerospace and Telecoms Firms
-
New Version Of Apostle Ransomware Reemerges In Targeted Attack On Higher Education
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Version Of Apostle Ransomware Reemerges In Targeted Attack On Higher Education
-
APT_trends_report_Q2_2021_Securelist
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT_trends_report_Q2_2021_Securelist
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Apostle Ransomware Analysis
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor evol-agrius
-
Iranian Cyber Response to Death of IRGC Head Would Likely Use Reported TTPs and Previous Access
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Iranian Cyber Response to Death of IRGC Head Would Likely Use Reported TTPs and Previous Access
Newest first. Details opens the report in Explore.