Agrius (Agonizing Serpens / BlackShadow) · APT / State-sponsored · RaqibCTI

Knowledge/Actors/Agrius (Agonizing Serpens / BlackShadow)Corpus

+ Request intel workspace

apt

Agrius (Agonizing Serpens / BlackShadow)

active · last signal 1y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Agonizing SerpensBlackShadowPink SandstormAMERICIUM

Attribution

Iran — Ministry of Intelligence and Security (MOIS)

Origin

Iran

First seen

2020

Last active

2025

Motivation

Sabotage

Attribution confidence

medium

MENA targeting

Israel, UAE

Sectors

Education, technology, diamond industry

MITRE ATT&CK

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel, UAE (Education, technology, diamond industry sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

No open hunts or recent alerts tracked against this actor right now.

Associated with

Related to

UNC215actorTechnique overlap
Fox KittenactorTechnique overlap
APT39 / ChaferactorTechnique overlap
RansomHubactorTechnique overlap
Nemesis KittenactorTechnique overlap
UNC1860actorTechnique overlap
Ballistic BobcatactorTechnique overlap
MontiactorTechnique overlap
Cl0p

Overview Attribution² TTPs²² Indicators Reporting⁴ Coverage

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

actor

Technique overlap

→OilRig (APT34)actorTechnique overlap

→Scarred Manticore (Storm-0861)actorTechnique overlap

→BladedFelineactorTechnique overlap

→Void Manticore (Storm-0842)actorTechnique overlap

→Tropic TrooperactorTechnique overlap

→LynxactorTechnique overlap

→BianLianactorTechnique overlap

→MuddyWateractorTechnique overlap

→RhysidaactorTechnique overlap

→MedusaactorTechnique overlap

→RansomHouseactorTechnique overlap

→Crypto24actorTechnique overlap

→WIRTEactorTechnique overlap

→Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap

→WarlockactorTechnique overlap

→Qilin (fka Agenda)actorTechnique overlap

→Sea TurtleactorTechnique overlap

→ALPHV / BlackCatactorTechnique overlap

→Imperial Kitten (CURIUM)actorTechnique overlap

→HEXANE (Lyceum)actorTechnique overlap

→Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap

→APT33actorTechnique overlap

→LockBit / LockBit 3.0actorTechnique overlap

←Mandiant M-Trends 2025 ReportreportORKL2025-04-24

←ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilitiesreportORKL2024-05-13

←SentinelOne WatchTower Intelligence-Driven Threat Hunting End of Year 2023reportORKL2024-02-15

←Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech SectorsreportORKL2024-01-16

Uses

Security Account ManagertechniqueATT&CK mapping
Archive via UtilitytechniqueATT&CK mapping
Lateral Tool TransfertechniqueATT&CK mapping
Remote System DiscoverytechniqueATT&CK mapping

+18 more relationships — see the relationships browser.

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

ORKLAgonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors ↗
ActorVoid Manticore (Storm-0842)
ActorScarred Manticore (Storm-0861)
ActorPredatory Sparrow
ActorCyberAv3ngers
ActorHandala