Agrius

Agrius is an Iran-linked threat actor active since at least 2020 and primarily known for intrusions against organizations in Israel and elsewhere in the Middle East. The group is widely tracked under multiple aliases including Agonizing Serpens, Americium, BlackShadow, Deadwood, Justice Blade, Pink Sandstorm, SharpBoys, and Spectral Kitten. Microsoft has linked Agrius, under the Pink Sandstorm name, to Iran’s Ministry of Intelligence and Security (MOIS). Agrius is notable for combining espionage, disruptive intrusion activity, data theft, and destructive or coercive operations that often masquerade as ransomware. Agrius initially became known for targeting Israeli organizations through exploitation of public-facing applications, followed by deployment of web shells, credential theft, lateral movement, and selective persistence. The group has repeatedly used ASPXSpy-derived web shells for foothold establishment and follow-on command execution, and has tunneled Remote Desktop Protocol traffic through compromised systems to move interactively within victim environments. Reported tradecraft also includes use of publicly available offensive tooling, abuse of compromised accounts, and post-compromise deployment of custom malware. The actor is strongly associated with destructive malware and pseudo-ransomware operations. Agrius used the DEADWOOD wiper and later deployed Apostle, a custom .NET malware family that began as a wiper and was subsequently adapted into functioning ransomware. This evolution is widely assessed as a tactical disguise rather than evidence of purely financial motivation, with ransomware-style messaging used to obscure sabotage or punitive intent. Agrius has also been linked to Moneybird, a later ransomware family assessed to reflect continued tool development while preserving the group’s disruptive operational model. A key Agrius backdoor is IPsec Helper, a custom .NET implant used post-exploitation for persistence, follow-on payload delivery, and data theft. The malware has been reported as installed as a Windows service. Agrius has also been observed using Windows service creation or modification for persistence more broadly, and modifying security-tool-related services to impair defenses and prevent security products from restarting after reboot. Additional defense evasion has included attempts to disable or remove endpoint security software. Victimology centers heavily on Israeli entities, but operations have also affected other Middle Eastern targets, including organizations in the United Arab Emirates. Reported targeting has included universities, insurance, and other enterprise environments, with some operations assessed as aimed at critical or nationally significant organizations. Agrius has been described as a high-risk destructive operator because it combines enterprise intrusion capability with wiper deployment and fake-ransomware tradecraft. Operationally, Agrius commonly follows a sequence of initial access via internet-facing systems, web-shell deployment, credential access, internal reconnaissance, lateral movement, data collection from databases and critical servers, and then disruptive action through wiping or ransomware-like payloads. The group has also used Base64-encoded web-shell variants to reduce detection and has leveraged command interpreters extensively after compromise. Overall, Agrius is best characterized as an Iranian state-linked intrusion set focused on espionage-enabled disruption, destructive attacks, and coercive cyber operations, especially against Israeli targets. Its known aliases, evolving malware families, and blend of custom tooling with public offensive utilities make it a significant actor in the broader Iranian cyber ecosystem.