IranAssessedMOISDestructiveActive 2020 – 2025Agrius
Also known asPink Sandstorm · Agonizing Serpens · DEV-0227 · BlackShadow · SharpBoys · AMERICIUM · Spectral Kitten · COBALT SHADOW
Summary
MOIS-linked Iranian destructive operations cluster (Microsoft: Pink Sandstorm / DEV-0227; CrowdStrike: Spectral Kitten). ESET: it has targeted victims in Israel and the United Arab Emirates since 2020, first deploying the Apostle wiper disguised as ransomware and later turning Apostle into fully fledged ransomware; in the 2023 attacks on Israeli education and technology organisations, Unit 42 found the ransom notes were a ruse. Its documented arsenal includes Apostle, Fantasy, Moneybird, DEADWOOD, MultiLayer, PartialWasher and BFG Agonizer. Latest public activity: Check Point observed Agrius-linked infrastructure scanning for vulnerable cameras across Israel during the June 2025 12-day war.
Attribution
Ministry of Intelligence and Security
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Public reporting links it to the MOIS
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Israel — IP camera reconnaissance scanning (12-day war) | 2025-06 | Israel | IoT / CCTV | Check Point (2026-03-01) |
| UNC2428 — fake Rafael recruitment portal delivering MURKYTOUR (overlap with Black Shadow)ASSESSED | 2024-10 | Israel | Defense, Individuals (job seekers) | Mandiant M-Trends 2025 (2025-04) — UNC2428, Rafael-themed recruitment lure, MURKYTOUR, October 2024; overlaps the INCD "Black Shadow" attribution |
| Agonizing Serpens — Israeli higher education & tech wiper attacks | 2023-01 – 2023-10 | Israel | Education, Technology | Unit 42 (2023-11-06) |
| Fantasy Wiper — Diamond Industry | 2022-02 – 2022-03 | Israel, South Africa, Hong Kong | Diamond Industry, HR Consulting, IT Services | ESET (2022-12-07) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 12
| Initial Access1 | T1190Exploit Public-Facing Application |
|---|---|
| Execution1 | T1059.001PowerShell |
| Persistence1 | T1543.003Windows Service |
| Stealth1 | T1036Masquerading |
| Defense Impairment1 | T1685Disable or Modify Tools |
| Credential Access2 | T1003.001LSASS MemoryT1110.003Password Spraying |
| Lateral Movement1 | T1021.001Remote Desktop Protocol |
| Impact4 | T1485Data DestructionT1486Data Encrypted for ImpactT1561.002Disk Structure WipeT1490Inhibit System Recovery |
Malware and tools 9
| Name | Description | Platform |
|---|---|---|
| Fantasy | Supply-chain Wiper | Windows |
| Moneybird | Wiper disguised as ransomware | Windows |
| DEADWOOD | Wiper | Windows |
| IPsec Helper | Backdoor | Windows |
| Apostle | Wiper-disguised-as-Ransomware | Windows |
| MultiLayer | Wiper | Windows |
| PartialWasher | Wiper | Windows |
| BFG Agonizer | Wiper | Windows |
| Sandals | Lateral-movement tool that spreads and executes the Fantasy wiper | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2018-13379 | 9.1 | Fortinet FortiOS SSL VPN (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Operates from commercial Israeli VPN infrastructure (Check Point, 2026)
- Stolen data published on social media and Telegram channels (Unit 42, 2023)
Reporting and advisories 5
- Unit 42
Agonizing Serpens (Agrius) targeting Israeli higher education and tech — MultiLayer, PartialWasher, BFG Agonizer - MITRE ATT&CK
Agrius (G1030) group profile - ESET
Fantasy Wiper — Diamond Industry - Check Point
Israel — IP camera reconnaissance scanning (12-day war) - Mandiant M-Trends 2025
UNC2428 — fake Rafael recruitment portal delivering MURKYTOUR (overlap with Black Shadow)