Agrius

Introduction

Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets. SentinelOne Agrius 2021 CheckPoint Agrius 2023 Public reporting has linked Agrius to Iran’s Ministry of Intelligence and Security (MOIS). Microsoft Iran Cyber 2023

Activities and Tactics

Country of Origin: 🇮🇷 Iran

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1018 Remote System Discovery
• T1685 Disable or Modify Tools
• T1046 Network Service Discovery
• T1078.002 Domain Accounts
• T1140 Deobfuscate/Decode Files or Information
• T1505.003 Web Shell
• T1005 Data from Local System
• T1583 Acquire Infrastructure
• T1074.001 Local Data Staging
• T1110.003 Password Spraying
• T1119 Automated Collection
• T1003.002 Security Account Manager
• T1560.001 Archive via Utility
• T1036 Masquerading
• T1003.001 LSASS Memory
• T1021.001 Remote Desktop Protocol
• T1190 Exploit Public-Facing Application
• T1110 Brute Force
• T1059.003 Windows Command Shell
• T1543.003 Windows Service
• T1041 Exfiltration Over C2 Channel
• T1570 Lateral Tool Transfer

ATT&CK technique IDs (denormalized)

• T1003.001
• T1003.002
• T1005
• T1018
• T1021.001
• T1036
• T1041
• T1046
• T1059.003
• T1074.001
• T1078.002
• T1110
• T1110.003
• T1119
• T1140
• T1190
• T1505.003
• T1543.003
• T1560.001
• T1570
• T1583
• T1685

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• NBTscan (S0590) — tool
• Mimikatz (S0002) — tool
• IPsec Helper (S1132) — malware
• Moneybird (S1137) — malware
• MultiLayer Wiper (S1135) — malware
• DEADWOOD (S1134) — malware
• BFG Agonizer (S1136) — malware
• ASPXSpy (S0073) — malware
• Apostle (S1133) — malware

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [6] SentinelOne Agrius 2021 Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024. [7] CheckPoint Agrius 2023 Marc Salinas Fernandez & Jiri Vinopal. (2023, May 23). AGRIUS DEPLOYS MONEYBIRD IN TARGETED ATTACKS AGAINST ISRAELI ORGANIZATIONS. Retrieved May 21, 2024. [8] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [9] Microsoft Iran Cyber 2023 Microsoft Threat Intelligence. (2023, May 2). Iran turning to cyber-enabled influence operations for greater effect. Retrieved May 21, 2024. [10] Unit42 Agrius 2023 Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.