Cyber Resilience

Threat actor · all actors

AgriusG1030 state

🇮🇷 IR

aka Agrius, Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow, DEV-0022, UNC2428, Black Shadow, SPECTRAL KITTEN

Last updated: 2026-08-20

0attributed CVEs
30ATT&CK techniques
0.0IDF score (tooling uniqueness)
0exclusive CVEs
—years active

About this actor

Agonizing Serpens is an Iranian-linked APT group that has been active since 2020. They are known for their destructive wiper and fake-ransomware attacks, primarily targeting Israeli organizations in the education and technology sectors. The group has strong connections to Iran's Ministry of Intelligence and Security and has been observed using various tools and techniques to bypass security measures. They aim to steal sensitive information, including PII and intellectual property, and inflict damage by wiping endpoints.

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G1030

Microsoftweather-system names

Pink Sandstorm

CrowdStrikenation-animal names

Agonizing SerpensSPECTRAL KITTEN

MandiantUNC uncategorised cluster

UNC2428

Unclassifiedno scheme matched

AgriusAMERICIUMBlackShadowDEV-0022Black Shadow

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 30 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

No activity events recorded.

Profile

CVERiskCVSSEPSSPublishedProducts
No attributed CVEs.

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-424 / 3080%
AC-321 / 3070%
AC-220 / 3067%
AC-620 / 3067%
CM-220 / 3067%
CM-620 / 3067%
AC-516 / 3053%
IA-215 / 3050%
SI-315 / 3050%
CA-714 / 3047%
CM-513 / 3043%
CM-713 / 3043%
RA-511 / 3037%
IA-59 / 3030%
SI-79 / 3030%

Co-occurring actors

None.

Similar actors

Similar TTPs

Same nation-state

Same category