Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Pink Sandstorm · Unknown · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

Pink Sandstorm

  • AMERICIUM
  • BlackShadow
  • DEV-0022
  • Agrius
  • Agonizing Serpens
  • UNC2428
  • Black Shadow
  • SPECTRAL KITTEN

MITRE G1030 ↗

Pink Sandstorm — ATT&CK rosePS

attack rose · 22 techniques across 11 tactics

Analyst brief

misp-galaxy + mitre-attack

Agonizing Serpens is an Iranian-linked APT group that has been active since 2020. They are known for their destructive wiper and fake-ransomware attacks, primarily targeting Israeli organizations in the education and technology sectors. The group has strong connections to Iran's Ministry of Intelligence and Security and has been observed using various tools and techniques to bypass security measures. They aim to steal sensitive information, including PII and intellectual property, and inflict damage by wiping endpoints.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

22 techniques · 11 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    1 technique

  3. Execution

    1 technique

  4. Persistence

    2 techniques

  5. Stealth

    3 techniques

  6. Defense impairment

    1 technique

  7. Credential access

    4 techniques

  8. Discovery

    2 techniques

  9. Lateral movement

    2 techniques

  10. Collection

    4 techniques

  11. Exfiltration

    1 technique

select a technique

Arsenal

7 malware · 2 tools
Malware
Malware · 7ATT&CK
IPsec HelperS1132 ↗
MoneybirdS1137 ↗
MultiLayer WiperS1135 ↗
DEADWOODS1134 ↗
BFG AgonizerS1136 ↗
ASPXSpyS0073 ↗
ApostleS1133 ↗
Tools
Tools · 2ATT&CK
NBTscanS0590 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

11 sources
  1. 1.oodaloop.com/archive/2024/01/02/critical-infrastructure-remains-the…
  2. 2.unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-secto…
  3. 3.socprime.com/blog/agonizing-serpens-attack-detection-iran-backed-ha…
  4. 4.therecord.media/iran-linked-hackers-target-israel-education-tech-secto…
  5. 5.enigmasoftware.com/moneybirdransomware-removal
  6. 6.research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-agai…
  7. 7.services.google.com/fh/files/misc/m-trends-2025-en.pdf
  8. 8.attack.mitre.org/groups/G1030
  9. 9.assets.sentinelone.com/sentinellabs/evol-agrius
  10. 10.learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-th…
  11. +1 more in the JSON record

Track Pink Sandstorm on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.