Agrius
Agrius is an Iran-attributed ransomware group with an ideological motive, tracked by Brandefense. It targets 12 sectors, including Government and Technology, in 14 countries, including the United States and India. It uses 65 MITRE ATT&CK techniques and exploits 5 known CVEs.
- Pink Sandstorm
- AMERICIUM
- Agonizing Serpens
- DEV-0227
- SharpBoys
- Spectral Kitten
- BlackShadow
- Origin
- Iran
- Techniques
- 65
- Exploited CVEs
- 5
- First seen
- Jan 1, 2020
- Last seen
- Nov 6, 2023
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
65 techniques across 14 of 15 tacticsVulnerabilities They Exploit.
Browse Vulnerability Intelligence →Linked through malware and tools
Targeted by malware or tools Agrius uses; not reported as exploited by the actor itself.
1 more vulnerability on the Brandefense platform
Exploitation status, severity and linked malware for every CVE
Request A DemoArsenal · Malware And Tools.
- Apostlemalware
- ASPXSpymalware
- BFG Agonizermalware
- Blackshadowmalware
- DEADWOODmalware
- Fantasymalware
- Fantasy wipermalware
- Impacketmalware
- IPsec Helpermalware
- Moneybirdmalware
- MultiLayermalware
- MultiLayer Wipermalware
- PartialWasher Wipermalware
- Sandalsmalware
- Sqlextractormalware
- 7-Ziptool
- GMERtool
- Mimikatztool
- NBTscantool
- NimScantool
- Plinktool
- ProcDumptool
- ProtonVPNtool
- pscp.exetool
- Rentdrv2tool
- WinEggDroptool
- WinSCPtool
Campaigns.
- Agonizing Serpens 2023 Israeli Destructive CampaignNov 2023
- Agrius destructive wiper campaign 2020May 2021
Indicators Of Compromise.
TLP:CLEAR- Hash
2fb88793f8571209c2fcf1be528ca1d59e7ac62e81e73ebb5a0d77b9d5a09cb8 - Hash
2a6e3b6e42be2f55f7ab9db9d5790b0cc3f52bee9a1272fc4d79c7c0a3b6abda
49 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Agrius.
Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets. Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.