Atlas Actors Sectors Requirements

⌘K

Atlas Actors Sectors Requirements

LOADING

Agrius (aka Agrius, Pink Sandstorm) · APT Atlas

Actors/Nation-state / APT/Asia

Agrius

APTIR · Iran

AKA Pink Sandstorm · DEV-0227 · BlackShadow

Microsoft: AMERICIUM

Iranian destructive-attack cluster operating wipers under ransomware cover.

Targets2

Sectors13

Threat types1

GIRs covered0/480

Active since2020

QUICK FACTS

TypeNation-state / APT

OriginIran

First seen2020

Type (verbatim)nation-state APT

GIR coverage0/480

TTPs19

Targets2

Sectors13

Victimology

Geographic footprint · 2 countries

origin · Irantargeted countries · 2

ASIA · 2

United Arab Emirates · Israel

Sectors targeted

13 of 40

Government83 actors Defense60 actors Financial Services61 actors Technology51 actors Telecom57 actors Education & Research50 actors Media & Journalism41 actors Transportation25 actors Logistics18 actors Transport & Logistics6 actors Consulting / Professional Services26 actors Industrials / Engineering23 actors Maritime21 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

DIS · Disinformation

MITRE ATT&CK · 19 techniques

Resource Development · 1

T1583Acquire Infrastructure

Initial Access · 1

T1190Exploit Public-Facing Application

Execution · 1

T1059.003Windows Command Shell

Persistence · 1

T1543.003Windows Service

Credential Access · 3

T1003.001LSASS Memory

Discovery · 2

T1018Remote System Discovery T1046Network Service Discovery

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1570Lateral Tool Transfer

Collection · 3

T1005Data from Local System T1119Automated Collection

Exfiltration · 1

T1041Exfiltration Over C2 Channel

Defense Impairment · 1

T1685Disable or Modify Tools

Stealth · 3

T1036Masquerading T1078.002Domain Accounts

GIR coverage

0 / 480 requirements satisfied

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

APT2nation-state

China · 6 targets · since 2010

APT5nation-state

China · 15 targets · since 2007

APT8nation-state

China · 5 targets · since —

APT14nation-state

China · 15 targets · since —

APT17nation-state

China · 10 targets · since 2009

APT20nation-state

China · 14 targets · since 2011

T1003.002

Security Account Manager

T1110Brute Force

T1560.001

Archive via Utility

T1140

Deobfuscate/Decode Files or Information