{"actor":{"id":"agrius","name":"Agrius","aliases":["Agrius","Pink Sandstorm","DEV-0227","BlackShadow"],"vendor_names":{"microsoft":"AMERICIUM","mandiant":"UNC3890","mitre":"G1030","secureworks":"IRON SANDSTORM"},"mitre_gid":"G1030","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"IR","origins":["IR"],"targets":["AE","IL"],"target_regions":[],"sectors":["consulting-professional-services","def","edu","fin","gov","industrials-engineering","logistics","mar","med","tec","tel","tra","transportation"],"threat_types":["dis"],"mitre_techniques":["T1003.001","T1003.002","T1005","T1018","T1021.001","T1036","T1041","T1046","T1059.003","T1078.002","T1110","T1119","T1140","T1190","T1543.003","T1560.001","T1570","T1583","T1685"],"gir_codes":[],"active_since":2020,"brief":"Iranian destructive-attack cluster operating wipers under ransomware cover.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:17.502129+00:00","updated_at":"2026-07-28T19:41:19.916+00:00","url":"https://aptatlas.net/actors/agrius"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/agrius/stix","navigator":"https://aptatlas.net/api/v1/actors/agrius/navigator"}}