Agrius (G1030) | Threat Actor Index

22

Techniques

9

Toolsets

2

CVEs Referenced

1

KEV Entries

CISA Known Exploited

About Agrius

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets. Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).

View MITRE record ↗

Techniques by Tactic (22)

Resource Development

T1583 Acquire Infrastructure

Initial Access

T1078.002 Domain AccountsT1190 Exploit Public-Facing Application

Execution

T1059.003 Windows Command Shell

Persistence

T1078.002 Domain AccountsT1505.003 Web ShellT1543.003 Windows Service

Privilege Escalation

T1078.002 Domain AccountsT1543.003 Windows Service

Stealth

T1036 MasqueradingT1078.002 Domain AccountsT1140 Deobfuscate/Decode Files or Information

Defence Impairment

T1685 Disable or Modify Tools

Credential Access

T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1110 Brute ForceT1110.003 Password Spraying

Discovery

T1018 Remote System DiscoveryT1046 Network Service Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1570 Lateral Tool Transfer

Collection

T1005 Data from Local SystemT1074.001 Local Data StagingT1119 Automated CollectionT1560.001 Archive via Utility

Exfiltration

T1041 Exfiltration Over C2 Channel

Toolsets (9)

🐛

ASPXSpy S0073

Malware · Windows

🐛

Apostle S1133

Malware · Windows

🐛

BFG Agonizer S1136

Malware · Windows

🐛

DEADWOOD S1134

Malware · Windows

🐛

IPsec Helper S1132

Malware · Windows

🐛

Moneybird S1137

Malware · Windows

🐛

MultiLayer Wiper S1135

Malware · Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

NBTscan S0590

Tool · Windows, Linux, macOS

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (5)

↑