APT ATLAS

⌘K

Atlas Actors145 Names507 Sectors40

Agrius (aka Agrius, Pink Sandstorm) · APT Atlas

Actors/Nation-state / APT/Asia

Agrius

G1030APTIR · Iran

AKA Pink Sandstorm · DEV-0227 · BlackShadow

Secureworks: IRON SANDSTORMMITRE: G1030Mandiant: UNC3890Microsoft: AMERICIUM

Iranian destructive-attack cluster operating wipers under ransomware cover.

Targets2

Sectors13

Threat types1

GIRs mapped0/480

Active since2020

Explore in atlas

Export

STIX 2.1 ATT&CK Navigator

QUICK FACTS

TypeNation-state / APT

OriginIran

First seen2020

Type (verbatim)nation-state APT

GIR mappings0/480

TTPs19

Targets2

Sectors13

Record updated2026-07-28

Also tracked as

4 vendor names · 3 other aliases

Open Rosetta Stone

Mandiant

UNC3890

Microsoft

AMERICIUM

MITRE

G1030

Secureworks

IRON SANDSTORM

UNATTRIBUTED ALIASESPink SandstormDEV-0227BlackShadow

Victimology

Geographic footprint · 2 countries

Export STIX

origin · Irantargeted countries · 2

ASIA · 2

United Arab Emirates · Israel

Sectors targeted

13 of 40

Government100 actors Defense72 actors Financial Services73 actors Technology60 actors Telecom71 actors Education & Research62 actors Media & Journalism48 actors Transportation31 actors Logistics21 actors Transport & Logistics6 actors Consulting / Professional Services34 actors Industrials / Engineering28 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

DIS · Disinformation

MITRE ATT&CK · 19 techniques

Resource Development · 1

T1583Acquire Infrastructure

Initial Access · 1

T1190Exploit Public-Facing Application

Execution · 1

T1059.003Windows Command Shell

Persistence · 1

T1543.003Windows Service

Credential Access · 3

T1003.001LSASS Memory

Discovery · 2

T1018Remote System Discovery T1046Network Service Discovery

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1570Lateral Tool Transfer

Collection · 3

T1005Data from Local System T1119Automated Collection

Exfiltration · 1

T1041Exfiltration Over C2 Channel

Defense Impairment · 1

T1685Disable or Modify Tools

Stealth · 3

T1036Masquerading T1078.002Domain Accounts

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer19 techniques · layer format 4.5

Related actors

By origin and actor type

AppleJeusnation-state

North Korea · 25 targets · since 2018

APT1nation-state

China · 17 targets · since 2006

APT10nation-state

China · 19 targets · since 2009

APT12nation-state

China · 11 targets · since 2009

APT14nation-state

China · 15 targets · since —

APT15nation-state

China · 25 targets · since 2010

T1003.002

Security Account Manager

T1110Brute Force

T1560.001

Archive via Utility

T1140

Deobfuscate/Decode Files or Information