LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1030: Agrius

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.[1][2] Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).[3]

EnterpriseG1030GroupObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G1030: Agrius describes [Agrius](https://attack.mitre.org/groups/G1030) is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.(Citation: SentinelOne Agrius 2021)(Citation: CheckPoint Agrius 2023) Public reporting has linked [Agrius](https://attack.mitre.org/groups/G1030) to Iran's Ministry of Intelligence and Security (MOIS).(Citation: Microsoft Iran Cyber 2023)

Executive priority

G1030: Agrius is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G1030: Agrius by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G1030: Agrius appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Agrius

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.[1][2] Public reporting has linked Agrius to Iran's Ministry of Intelligence and Security (MOIS).[3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

22 rows
DomainIDNameRelationship / procedure
EnterpriseT1018Remote System Discovery

Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments.[4]

EnterpriseT1685Disable or Modify Tools

Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, GMER64.sys typically used for anti-rootkit functionality, to selectively stop and remove security software processes.[4]

EnterpriseT1046Network Service Discovery

Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.[4]

EnterpriseT1078.002Domain AccountsSub-technique

Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.[4]

EnterpriseT1140Deobfuscate/Decode Files or Information

Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.[1]

EnterpriseT1505.003Web ShellSub-technique

Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.[1]

EnterpriseT1005Data from Local System

Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.[4]

EnterpriseT1583Acquire Infrastructure

Agrius typically uses commercial VPN services for anonymizing last-hop traffic to victim networks, such as ProtonVPN.[1]

EnterpriseT1074.001Local Data StagingSub-technique

Agrius has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.[4]

EnterpriseT1110.003Password SprayingSub-technique

Agrius engaged in password spraying via SMB in victim environments.[4]

EnterpriseT1119Automated Collection

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.[4]

EnterpriseT1003.002Security Account ManagerSub-technique

Agrius dumped the SAM file on victim machines to capture credentials.[4]

EnterpriseT1560.001Archive via UtilitySub-technique

Agrius used 7zip to archive extracted data in preparation for exfiltration.[4]

EnterpriseT1036Masquerading

Agrius used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.[4]

EnterpriseT1003.001LSASS MemorySub-technique

Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.[4]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts.[1] Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.[4]

EnterpriseT1190Exploit Public-Facing Application

Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.[1]

EnterpriseT1110Brute Force

Agrius engaged in various brute forcing activities via SMB in victim environments.[4]

EnterpriseT1059.003Windows Command ShellSub-technique

Agrius uses ASPXSpy web shells to enable follow-on command execution via cmd.exe.[1]

EnterpriseT1543.003Windows ServiceSub-technique

Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.[4]

EnterpriseT1570Lateral Tool Transfer

Agrius downloaded some payloads for follow-on execution from legitimate filesharing services such as ufile.io and easyupload.io.[2]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
MalwareEnterprise

S1132: IPsec Helper

IPsec Helper is a post-exploitation remote access tool linked to Agrius operations. This malware shares significant programming and functional overlaps with Apostle ransomware, also linked to Agrius. IPsec Helper provides basic remote access tool functionality such as uploading files from victim systems, running commands, and deploying additional payloads.[1]

Windows
MalwareEnterprise

S1137: Moneybird

Moneybird is a ransomware variant written in C++ associated with Agrius operations. The name "Moneybird" is contained in the malware's ransom note and as strings in the executable.[1]

Windows
MalwareEnterprise

S1134: DEADWOOD

DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.[1]

Windows
MalwareEnterprise

S1133: Apostle

Apostle is malware that has functioned as both a wiper and, in more recent versions, as ransomware. Apostle is written in .NET and shares various programming and functional overlaps with IPsec Helper.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · ToolS0590: NBTscanEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · ToolS0002: MimikatzEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · TechniqueT1078.002: Domain AccountsEnterpriseuses · MalwareS1132: IPsec HelperEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1505.003: Web ShellEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1583: Acquire InfrastructureEnterpriseuses · MalwareS1137: MoneybirdEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1110.003: Password SprayingEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1003.002: Security Account ManagerEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · MalwareS1135: MultiLayer WiperEnterpriseuses · TechniqueT1190: Exploit Public-Facing ApplicationEnterpriseuses · MalwareS1134: DEADWOODEnterpriseuses · TechniqueT1110: Brute ForceEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.0
Created
Modified
Raw hash
b502eaaa490ff1a9...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.0Current bundleb502eaaa490f…
19.11.0Older bundlec9d623aad68f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    SentinelOne Agrius 2021

    Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.

    Open source URL
  2. [2]
    CheckPoint Agrius 2023

    Marc Salinas Fernandez & Jiri Vinopal. (2023, May 23). AGRIUS DEPLOYS MONEYBIRD IN TARGETED ATTACKS AGAINST ISRAELI ORGANIZATIONS. Retrieved May 21, 2024.

    Open source URL
  3. [3]
    Microsoft Iran Cyber 2023

    Microsoft Threat Intelligence. (2023, May 2). Iran turning to cyber-enabled influence operations for greater effect. Retrieved May 21, 2024.

    Open source URL
  4. [4]
    Unit42 Agrius 2023

    Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.

    Open source URL
  5. [5]
    AMERICIUM

    (Citation: Microsoft Threat Actor Naming July 2023)

  6. [6]
    Agonizing Serpens

    (Citation: Unit42 Agrius 2023)

  7. [7]
    BlackShadow

    (Citation: CheckPoint Agrius 2023)

  8. [8]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  9. [9]
    Pink Sandstorm

    (Citation: Microsoft Threat Actor Naming July 2023)

  10. [10]
    mitre-attackG1030
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use