CVE Intelligence
Home / Threat actors / Agrius

Agrius G1030

🔔 Create alert

Also known as: Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1
associated CVEs
26
Techniques
9
Malware and tools

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets. Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).

Ransomware operations linked to this group ransomware.live

blackshadow

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2018-13379 Critical · 9.8 KEV Ransomware Fortinet FortiOS SSL VPN Path Traversal Vulnerability
“Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.”

Techniques by tactic

Resource Development
T1583 Acquire Infrastructure
Initial Access
T1078.002 Domain AccountsT1190 Exploit Public-Facing Application
Execution
T1059.003 Windows Command Shell
Persistence
T1078.002 Domain AccountsT1505.003 Web ShellT1543.003 Windows Service
Privilege Escalation
T1078.002 Domain AccountsT1543.003 Windows Service
Stealth
T1036 MasqueradingT1078.002 Domain AccountsT1140 Deobfuscate/Decode Files or Information
Defense Impairment
T1685 Disable or Modify Tools
Credential Access
T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1110 Brute ForceT1110.003 Password Spraying
Discovery
T1018 Remote System DiscoveryT1046 Network Service Discovery
Lateral Movement
T1021.001 Remote Desktop ProtocolT1570 Lateral Tool Transfer
Collection
T1005 Data from Local SystemT1074.001 Local Data StagingT1119 Automated CollectionT1560.001 Archive via Utility
Exfiltration
T1041 Exfiltration Over C2 Channel

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.