Pink SandstormThreat actor
- agonizing serpens
- Agrius
- americium
- black shadow
- dev-0022
- spectral kitten
- unc2428
Agonizing Serpens is an Iranian-linked APT group that has been active since 2020. They are known for their destructive wiper and fake-ransomware attacks, primarily targeting Israeli organizations in the education and technology sectors.From MISP Galaxy
Last reported 7 months ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1110.003Password Spraying
“…y la NSA publicada en octubre de 2024 documentó una campaña de un año en la que actores iraníes usaron password spraying y MFA push‑bombing (inundar a los usuarios con solicitudes de inicio de sesión hasta que alguien apruebe una por error) para…”
- T1195Supply Chain Compromise
“When it comes to attacks that give bad actors a lot of bang for their buck, supply chain compromise typically reigns supreme.”
- T1219Remote Access Tools
“If you rely on MSPs, inquire about how they secure their remote access tools and whether they've reviewed their own exposure in light of the conflict.”
- T1534Internal Spearphishing
“The group is also known to favor internal spearphishing from already-compromised inboxes – emails from a colleague's account rather than an external sender – with a high success rate, for obvious reasons.”
- T1566.001Spearphishing Attachment
“Spearphishing attachments and links have long been the most popular initial access techniques among most Iran-aligned APT groups, including OilRig and APT33.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
El impacto en la ciberseguridad de la guerra en Irán: riesgos clave que debe monitorear“En 2022, ESET Research documentó cómo el grupo Agrius, alineado con Irán, desplegó un wiper destructivo llamado Fantasy mediante un ataque a la cadena de suministro que abusó de un desarrollador de software israelí, afectando a objetivos…”
-
Cyber fallout from the Iran war: What to have on your radar“Back in 2022, ESET Research documented how the Iran-aligned Agrius group deployed a destructive wiper called Fantasy through a supply-chain attack that abused an Israeli software developer, hitting targets in various verticals and well beyond Israel.”
Thanks — we review every report.