pink-sandstorm-agrius

• SKILL.mdcore · 22,136 bytes

# Pink Sandstorm (Agrius, Agonizing Serpens, BlackShadow) — Adversary Emulation Profile

Pink Sandstorm (MITRE ATT&CK **G1030**) is an Iranian threat actor active since at least 2020, linked to Iran's Ministry of Intelligence and Security (MOIS). The group is notable for a series of **destructive wiper and pseudo-ransomware operations** primarily targeting Israeli organizations, with secondary operations against targets in the UAE, South Africa, and Hong Kong. Agrius deliberately **disguises destructive wiper attacks as ransomware**, using extortion personas (BlackShadow, Moneybird, n3tw0rm) to mask its true intent — strategic disruption and data destruction aligned with Iranian state interests. The group operates a lineage of custom .NET and C++ wipers (Apostle → Fantasy → MultiLayer → BFG Agonizer) alongside the IPsec Helper backdoor, ASPXSpy web shells, and public offensive tools (Mimikatz, Plink, NBTscan). Since the October 2023 Israel-Hamas war, Microsoft has observed Pink Sandstorm collaborating with Hezbollah cyber units and escalating hack-and-leak operations against Israeli targets.

## Attribution & motivation

- **Sponsor / nation:** Islamic Republic of Iran — Ministry of Intelligence and Security (MOIS). Microsoft's 2023 Iran threat report formally linked Pink Sandstorm / AMERICIUM to MOIS operations. The group operates under multiple extortion personas: BlackShadow (Shirbit, 2020), Justice Blade, Malek Team, and Moneybird.
- **Motivation:** Primarily **destructive / disruptive operations** — wiping data and rendering systems inoperable while masquerading as financially motivated ransomware. Secondary motivations include **espionage and data theft** (PII, intellectual property, database exfiltration) and **hack-and-leak influence operations** designed to cause political embarrassment and societal disruption in Israel.
- **Attribution confidence:** **High.** Backed by Microsoft threat intelligence formal attribution (AMERICIUM / Pink Sandstorm → MOIS), SentinelOne (Agrius lineage), Check Point (Moneybird), ESET (Fantasy supply-chain), and Palo Alto Unit 42 (Agonizing Serpens) consistent reporting. Code-level overlaps across Apostle, Fantasy, IPsec Helper, MultiLayer, and DEADWOOD confirm a single actor operating under rotating aliases.

## Targeting

- **Sectors:** Insurance and financial services; diamond industry (mining, wholesale, retail); IT and technology services; higher education and academic institutions; government and public services; healthcare (hospital hack-and-leak post-Oct 2023); HR consulting firms.
- **Regions:** Primary focus on **Israel** (near-exclusive targeting in most campaigns). Secondary targets in **UAE**, **South Africa**, and **Hong Kong** (diamond industry supply chain). Post-2023 expansion to broader Middle Eastern targets.