{"actor":{"id":"agrius","name":"Agrius","aliases":["Agrius","Pink Sandstorm","DEV-0227","BlackShadow"],"vendor_names":{"microsoft":"AMERICIUM","secureworks":"IRON SANDSTORM","mitre":"G1030","mandiant":"UNC3890"},"mitre_gid":"G1030","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"IR","origins":["IR"],"targets":["AE","IL"],"target_regions":[],"sectors":["edu","fin","mar","tel","logistics","transportation","tra","gov","def","consulting-professional-services","med","tec","industrials-engineering"],"threat_types":["dis"],"mitre_techniques":["T1560.001","T1583","T1190","T1119","T1003.001","T1041","T1005","T1140","T1003.002","T1543.003","T1036","T1110","T1078.002","T1021.001","T1570","T1685","T1059.003","T1046","T1018"],"gir_codes":[],"active_since":2020,"brief":"Iranian destructive-attack cluster operating wipers under ransomware cover.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:17.502129+00:00","updated_at":"2026-07-28T19:41:19.916+00:00","url":"https://aptatlas.net/actors/agrius"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/agrius/stix","navigator":"https://aptatlas.net/api/v1/actors/agrius/navigator"}}