Pink Sandstorm  (Back to overview)

aka: AMERICIUM, Agonizing Serpens, Agrius, BlackShadow, DEV-0022

Agonizing Serpens is an Iranian-linked APT group that has been active since 2020. They are known for their destructive wiper and fake-ransomware attacks, primarily targeting Israeli organizations in the education and technology sectors. The group has strong connections to Iran's Ministry of Intelligence and Security and has been observed using various tools and techniques to bypass security measures. They aim to steal sensitive information, including PII and intellectual property, and inflict damage by wiping endpoints.

Associated Families

There are currently no families associated with this actor.

2024-01-02OODA LoopEmilio Iasiello
Critical Infrastructure Remains the Brass Ring for Cyber Attackers in 2024
Pink Sandstorm
2023-11-09SOC PrimeDaryna Olyniychuk
Agonizing Serpens Attack Detection: Iran-Backed Hackers Target Israeli Tech Firms and Educational Institutions
Pink Sandstorm
2023-11-06Palo Alto Networks Unit 42Assaf Dahan, Daniel Frank, Or Chechik, Tom Fakterman
Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors
Pink Sandstorm
2023-11-06The RecordDaryna Antoniuk
Iran-linked hackers attack Israeli education and tech organizations
Pink Sandstorm
Moneybird Ransomware
Pink Sandstorm
2023-05-24Check Point ResearchJiri Vinopal, Marc Salinas Fernandez
Agrius Deploys MoneyBird in Targeted Attacks against Israeli Organizations
Pink Sandstorm

Credits: MISP Project