Agrius dresses destruction up as extortion: its victims receive ransom notes, but in many cases the data was wiped and could never have been recovered by paying. This profile covers the Iran-linked group that MITRE ATT&CK tracks as G1030 and Microsoft calls Pink Sandstorm, active since 2020 with an emphasis on Israeli targets. It draws on MITRE ATT&CK v20, SentinelLabs, Check Point Research, Palo Alto Networks Unit 42 and Microsoft's threat actor naming table, and follows each source's attribution wording. It is written for incident responders, SOC analysts and infrastructure teams in Israel, the Gulf and any organisation with exposed web servers, and it stays at behaviour level with no malware internals. For wipers as a class, see the Wiper Malware Guide.
Key takeaways
- The ransom note can be a decoy. SentinelLabs describes Agrius masquerading destructive attacks as ransomware; plan recovery as if no decryptor will ever exist.
- Exposed web servers are the front door. Every source read describes exploitation of internet-facing web applications followed by ASPXSpy web shell variants.
- Credentials drive the spread. Unit 42 saw Mimikatz, SAM dumping, SMB password spraying and brute force before lateral movement over RDP.
- Data theft comes before the wipe. In 2023 Unit 42 saw personal data such as ID numbers and passport scans extracted from databases and exfiltrated before wipers ran.
- Security tools are attacked directly. Unit 42 recorded attempts to tamper with EDR services and to use vulnerable drivers to kill security processes, so tamper protection and driver blocklists matter.
Who they are (names and aliases)
MITRE ATT&CK describes Agrius as an Iranian threat actor active since 2020, notable for ransomware and wiper operations in the Middle East with an emphasis on Israel, and notes that public reporting links it to Iran's Ministry of Intelligence and Security (MOIS). Sources differ in confidence: SentinelLabs (2021) assessed with medium confidence that it is Iranian-affiliated; Check Point (2023) calls it Iran-aligned, says recent reports tie it to MOIS, and adds that its affiliation within Iran is not clear.
| Name | Source | Notes |
|---|---|---|
| Agrius (G1030) | MITRE ATT&CK; SentinelLabs | SentinelLabs named the group in May 2021 |
| Pink Sandstorm | Microsoft | Microsoft lists Iran as origin and AMERICIUM, SPECTRAL KITTEN, Agrius, Deadwood, BlackShadow, SharpBoys, FireAnt and Justice Blade as other names |
| Agonizing Serpens | Palo Alto Networks Unit 42 | Unit 42 also lists DEV-0022 |
| BlackShadow | Check Point; MITRE | Extortion persona; Check Point calls it the first known alias, used to extort Shirbit |
The group runs several extortion and leak personas, so a "new" ransomware brand hitting Israeli organisations may be Agrius under another name. No source read for this page names individuals; this page names none. For the wider Iranian ecosystem, see the Iran State Cyber Operations Guide.
Malware associated in ATT&CK
| Software | Type | What ATT&CK and vendors say |
|---|---|---|
| Apostle (S1133) | Wiper turned ransomware | .NET; began as a wiper and was modified into working ransomware; ransom message suggested a UAE target (SentinelLabs) |
| IPsec Helper (S1132) | Backdoor | .NET remote access tool registered as a service; overlaps with Apostle |
| DEADWOOD (S1134) | Wiper | First seen in an unattributed 2019 wiping event in Saudi Arabia, later used in Agrius operations |
| Moneybird (S1137) | Ransomware | C++, built for targeted use; reported by Check Point in May 2023 |
| MultiLayer Wiper (S1135); BFG Agonizer (S1136) | Wipers | Used in the 2023 campaign against Israeli education and technology organisations (Unit 42) |
| ASPXSpy (S0073) | Web shell | Custom variants used for initial foothold across campaigns |
Targeting and motivation
- Geography: primarily Israel, with victims in the wider Middle East including the UAE (SentinelLabs). Unit 42 saw no non-Israeli victims in its 2023 telemetry.
- Sectors: Unit 42's 2023 campaign hit higher education and technology. Check Point cites earlier attacks on the insurer Shirbit and on Bar Ilan University.
- Motivation: disruption, data theft and psychological pressure in a state context rather than profit. SentinelLabs describes an evolution from espionage to destructive attacks presented as ransomware.
- Leaks: stolen data is published through extortion personas, adding reputational and privacy harm. See the Hack and Leak Operations Guide.
- Who should care: Israeli organisations and their suppliers above all, but any organisation running public IIS or ASP.NET applications faces the same entry technique.
Tactics and techniques (MITRE ATT&CK)
All IDs below are ATT&CK v20 techniques recorded against G1030, except where marked as NHI Mgmt Group mapping of a vendor description.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Initial access | T1190 Exploit Public-Facing Application | Vulnerable internet-facing web servers; access often via ProtonVPN nodes | Patch and WAF public apps; remove unused ones |
| Persistence | T1505.003 Web Shell | ASPXSpy variants, hidden in text files disguised as certificates (Check Point) | File integrity monitoring on web roots |
| Discovery | T1046 Network Service Discovery; T1018 Remote System Discovery | Public scanners such as NBTscan and SoftPerfect | Alert on internal scanning from web servers |
| Credential access | T1003.001 LSASS Memory; T1003.002 Security Account Manager | Mimikatz, ProcDump, SAM dumping | Credential Guard, LSA protection, ASR rule for LSASS |
| Credential access | T1110.003 Password Spraying; T1110 Brute Force | SMB spraying and brute force | Lockout policy; alert on failed SMB logons |
| Lateral movement | T1021.001 Remote Desktop Protocol; T1078.002 Domain Accounts | Manual RDP, tunnelled through web shells and Plink | Block RDP from DMZ servers; tiered admin accounts |
| Persistence | T1543.003 Windows Service | IPsec Helper installed as a service | Alert on new services (Event ID 7045) |
| Collection and exfiltration | T1005 Data from Local System; T1560.001 Archive via Utility; T1041 Exfiltration Over C2 Channel | Database extraction, 7-Zip archives, WinSCP and pscp transfer | Database activity monitoring; egress controls |
| Defence impairment | T1685 Disable or Modify Tools | EDR service tampering and vulnerable driver loaders | Tamper protection; vulnerable driver blocklist |
| Defence impairment (NHIMG mapping) | T1685.005 Clear Windows Event Logs | MultiLayer wiper clears event logs (Unit 42) | Forward logs off-host in real time |
| Impact (NHIMG mapping) | T1485 Data Destruction; T1561.002 Disk Structure Wipe; T1490 Inhibit System Recovery; T1486 Data Encrypted for Impact | File wiping, boot sector overwrite, shadow copy deletion; Apostle and Moneybird encryption | Offline, immutable backups with tested restores |
How they abuse identities and credentials
- Web server identities: a web shell runs as the application pool identity. If that identity is a domain account or has rights beyond the site, the foothold becomes a domain foothold. Run IIS application pools under virtual accounts or gMSAs with no interactive logon rights. See the Group Managed Service Accounts (gMSA) Guide.
- Cached and local credentials: LSASS and SAM dumping yields local administrator hashes. A shared local admin password across servers turns one dump into many hosts; use Windows LAPS.
- Spraying against SMB: weak or reused passwords on domain accounts let the group expand without exploits. Smart lockout, banned password lists and alerting on Event ID 4625 bursts matter.
- Domain accounts over RDP: ATT&CK records use of valid domain accounts. Admins logging in to DMZ web servers with domain admin rights leave exactly the credentials the group harvests.
- Cloud admin accounts: not documented for Agrius in the sources read, but the Stryker Intune wiper attack, claimed by the Handala persona that the US Justice Department says is run by MOIS, shows a single hijacked admin account being used to wipe devices at scale. It is not attributed to Agrius.
Notable incidents
| Date | Event | Source |
|---|---|---|
| 2020 | Agrius observed operating in Israel; Shirbit extortion under the BlackShadow persona | SentinelLabs; Check Point |
| May 2021 | SentinelLabs names Agrius and documents Apostle's shift from wiper to ransomware, DEADWOOD and IPsec Helper | SentinelLabs |
| 2023 (reported May) | Moneybird ransomware used against Israeli organisations; data leaked through a known alias | Check Point |
| January to October 2023 | Campaign against Israeli higher education and technology: data theft then MultiLayer, PartialWasher and BFG Agonizer wipers | Unit 42 |
Unit 42 linked the 2023 activity to the group with high confidence based on code overlaps with Apostle, Fantasy and IPsec Helper, reused web shell code and the destructive pattern. No law enforcement takedown or indictment of Agrius is recorded in the sources read.
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| New or changed .aspx files, or text files renamed to .aspx, in web roots | File integrity monitoring; EDR file events | ASPXSpy variants were staged as disguised files |
| w3wp.exe spawning cmd.exe, PowerShell or scanners | EDR; Sysmon Event ID 1 | Classic web shell behaviour |
| Access to LSASS or SAM hive copies | EDR; Sysmon Event ID 10; ASR audit events | Credential dumping precedes spread |
| Bursts of failed SMB logons from one internal host | Security Event IDs 4625 and 4771 | Password spraying and brute force |
| New services and vulnerable driver loads | Event ID 7045; Sysmon Event ID 6 | Backdoor persistence and EDR killing |
| Large archive creation and outbound SCP or SFTP from servers | EDR; NetFlow; firewall | Exfiltration before destruction |
| Inbound sessions to web apps from commercial VPN exit nodes | WAF and web logs enriched with IP intelligence | Sources describe ProtonVPN use |
Phased response plan
- Shrink the web attack surface: inventory internet-facing IIS and other web apps, remove the unused, patch KEV-listed flaws first and put the rest behind a WAF. See the Microsoft Exchange Server Security Guide where Exchange is exposed.
- Contain the web tier: block outbound RDP, SMB and SSH from DMZ web servers to internal networks and run application pools under least-privilege identities. Test in a staging copy and keep the previous firewall rules for rollback.
- Protect credentials: enable Credential Guard and LSA protection, deploy Windows LAPS and switch on the ASR rule that blocks credential stealing from LSASS, in audit mode first.
- Protect the defenders: enable EDR tamper protection and the Microsoft vulnerable driver blocklist. See the Bring Your Own Vulnerable Driver and EDR Killers Guide.
- Make wipes survivable: keep immutable or offline backups with separate credentials and rehearse a full domain and server restore. See the Backup Security and Immutable Backup Guide.
- Prepare the decision: agree in advance that Israeli-targeted "ransomware" from unknown brands is handled as a possible wiper, so teams restore rather than wait on negotiations. See the Wiper Attack Response Playbook.
Decision guidance
- Pay or restore: with Agrius-style operations, payment buys nothing if the data was wiped. Treat restore capability as the only reliable recovery path and involve national CERTs early.
- Small organisations: move public websites to managed hosting outside the corporate domain, enforce MFA on remote access and keep an offline backup. That removes most of the documented chain.
- Large organisations: add web shell hunting, database activity monitoring for bulk PII extraction, and EDR coverage with tamper protection on every web server.
Metrics
- Number of internet-facing web apps with an unpatched KEV-listed flaw (target zero).
- Percentage of web servers with file integrity monitoring on web roots.
- Percentage of servers with Credential Guard or LSA protection enabled.
- Percentage of EDR agents with tamper protection on.
- Time to restore a representative server and a domain controller from offline backup, measured in exercises.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Patch public-facing applications | SI-2, RA-5 | ID.RA-01, PR.PS-02 |
| Segment DMZ from internal network | SC-7, AC-4 | PR.IR-01 |
| Least privilege for service identities | AC-6, IA-5 | PR.AA-05 |
| Integrity monitoring and EDR | SI-7, SI-4 | DE.CM-09 |
| Backups and recovery | CP-9, CP-10 | PR.DS-11, RC.RP-01 |
| Incident handling | IR-4 | RS.MA-01 |
Common failure patterns
- Waiting for a decryptor: treating the note at face value delays restore while nothing can be recovered.
- Web servers joined to the domain with broad rights: a web shell inherits a path straight to domain accounts.
- Shared local admin passwords: one SAM dump unlocks the estate.
- Backups reachable with domain credentials: wipers and operators destroy what they can reach.
- Logs kept only on the host: the wiper clears event logs, taking the evidence with it.
Practitioner checklist
- Inventory and patch all internet-facing web applications; remove those not needed.
- Monitor web roots for new or renamed .aspx files and w3wp.exe child processes.
- Block outbound RDP, SMB and SSH from DMZ servers to internal networks.
- Run application pools under least-privilege virtual accounts or gMSAs.
- Deploy Windows LAPS, Credential Guard and the LSASS ASR rule.
- Enable EDR tamper protection and the vulnerable driver blocklist.
- Forward Windows event logs off-host in real time.
- Keep immutable or offline backups with separate credentials and test restores.
- Pre-agree a wiper-first response for unexplained ransomware brands.
Standards and references
- MITRE ATT&CK: Agrius (G1030)
- Microsoft: How Microsoft names threat actors
- SentinelLabs: From Wiper to Ransomware, the Evolution of Agrius
- Check Point Research: Agrius Deploys Moneybird in Targeted Attacks Against Israeli Organizations
- Palo Alto Networks Unit 42: Agonizing Serpens Targets Israeli Tech and Higher Ed Sectors
- CISA: Known Exploited Vulnerabilities Catalog
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Wiper Malware Guide · Iran State Cyber Operations Guide · MuddyWater Threat Actor Profile · APT33 Threat Actor Profile Guide · Wiper Attack Response Playbook