Agrius

Agrius is an Iran-linked threat actor active since at least 2020 and primarily known for targeting organizations in Israel and elsewhere in the Middle East. The group has been assessed with medium confidence as affiliated with Iran and is widely tracked under multiple aliases including Pink Sandstorm, Americium, BlackShadow, Deadwood, Justice Blade, SharpBoys, Spectral Kitten, and Agonizing Serpens. Agrius has conducted both espionage and destructive operations, with a pattern of stealing data from victim environments and then deploying wiper or ransomware-like payloads to disrupt operations and complicate response. The actor is especially notable for using wipers disguised as ransomware. Malware associated with Agrius includes DEADWOOD and Apostle, with Apostle initially functioning as a wiper before later being adapted into operational ransomware. This evolution indicates a disruptive model in which ransomware tradecraft is used primarily for coercion, sabotage, or cover for destructive activity rather than conventional profit-seeking. Agrius has also used the custom .NET backdoor IPsec Helper for persistence, follow-on access, exfiltration, and deployment of additional malware. In later activity, the group used a .NET loader known as Jennlog to decrypt and execute Apostle in memory and was also observed using a Jennlog variant to load OrcusRAT. Operationally, Agrius has exploited public-facing applications for initial access and then deployed ASPXSpy-derived web shells for persistence and remote control. The group has tunneled RDP through web shells and used tools such as Plink and compromised accounts to move laterally inside victim networks. Reported post-compromise behavior includes credential harvesting, use of publicly available offensive tooling, service-based persistence, data collection from databases and critical servers, and exfiltration prior to destructive actions. Agrius has also attempted to impair defenses by modifying security-tool services and using a driver to terminate or remove security software processes. Victimology centers heavily on Israeli organizations, with additional evidence of targeting in the United Arab Emirates and broader Middle Eastern environments. Observed victims and sectors include technology, education, insurance, and other enterprise organizations. The group’s tradecraft and targeting align more closely with state-backed disruptive and espionage objectives than with purely criminal ransomware operations.