Agrius

Agrius is an Iran-linked threat actor, also known as Agonizing Serpens, Pink Sandstorm, Americium, BlackShadow, Deadwood, Justice Blade, SharpBoys, and Spectral Kitten. Active since at least 2020, it has conducted espionage and destructive operations principally against Israeli organizations and other Middle Eastern targets. The group has targeted technology and educational organizations and is associated with activity against a critical nation-owned facility in the United Arab Emirates. Agrius is characterized by destructive operations in which wiper malware is presented as ransomware to create punitive or coercive effects rather than to generate revenue. It has used the DEADWOOD wiper and Apostle, a .NET malware family that evolved from a wiper into functional ransomware. The group likely retains a sabotage-oriented mission despite Apostle’s ransomware functionality. The actor has compromised public-facing applications, deployed ASPXSpy-derived web shells, and used victim VPN access for post-compromise operations. Its web shells have supported RDP tunneling and lateral movement using compromised accounts. Agrius has also used public offensive-security tooling for credential harvesting and lateral movement, collected data from databases and critical servers, and employed wiping for anti-forensic purposes. Its custom .NET backdoor IPsec Helper has been deployed selectively for persistence, data exfiltration, and delivery of additional payloads; it establishes persistence through a Windows service. Agrius has additionally impaired defenses by modifying EDR-related services and using a kernel driver to stop or remove security-product processes.