Agrius
Threat actorAttributed to Iran by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- AgriusOur name
- BlackShadowCheck Point
- AMERICIUMMicrosoft
- Pink SandstormMicrosoft
- Agonizing SerpensPalo Alto Networks
Targets
Regions: Middle East, Israel
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.002Security Account Manager
- T1005Data from Local System
- T1018Remote System Discovery
- T1021.001Remote Desktop Protocol
- T1036Masquerading
- T1041Exfiltration Over C2 Channel
- T1046Network Service Discovery
- T1059.003Windows Command Shell
- T1074.001Local Data Staging
- T1078.002Domain Accounts
- T1110Brute Force
- T1110.003Password Spraying
- T1119Automated Collection
- T1140Deobfuscate/Decode Files or Information
- T1190Exploit Public-Facing Application
- T1505.003Web Shell
- T1543.003Windows Service
- T1560.001Archive via Utility
- T1570Lateral Tool Transfer
- T1583Acquire Infrastructure
- T1685Disable or Modify Tools
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.