Agrius

Agrius is an Iranian state-linked threat actor active since at least 2020, assessed by multiple vendors to operate on behalf of Iran's Ministry of Intelligence and Security (MOIS). The group is best known for destructive wiper and fake-ransomware campaigns aimed primarily at Israeli organizations across the technology, education, insurance, and healthcare sectors. Agrius gains initial access by exploiting public-facing web applications, deploys ASPXSpy-based web shells for persistence, and ultimately delivers custom wipers such as Apostle and DEADWOOD to destroy data and disrupt operations. Microsoft tracks the same cluster as Pink Sandstorm and AMERICIUM.