🇪🇬

Storm-0867

APT Group ETDA ✓

Also Known As 1 names

DEV-0867

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin 🇪🇬 EG

Last Updated 03 Feb 2024

MITRE ATT&CK 5

T1027 T1036.005 T1078 T1203 T1566.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 8 entries

Agrius SentinelLabs

DEV-0227 Microsoft

BlackShadow Kaspersky

SharpBoys ?

AMERICIUM Microsoft

Pink Sandstorm Microsoft

Agonizing Serpens Palo Alto

Spectral Kitten CrowdStrike

Observed Target Countries 3

Based on ETDA data — countries highlighted in red

Hong Kong Israel South Africa

Description

(SentinelLabs) A new threat actor SentinelLabs track as Agrius was observed operating in Israel beginning in 2020. An analysis of what at first sight appeared to be a ransomware attack revealed new variants of wipers that were deployed in a set of destructive attacks against Israeli targets. The operators behind the attacks intentionally masked their activity as ransomware attacks.

Tools Used 10

Apostle ASPXSpy BFG Agonizer Wiper DEADWOOD Fantasy IPsec Helper Moneybird MultiLayer Wiper PartialWasher Wiper Sqlextractor

Operations 2

2022-02 Fantasy – a new Agrius wiper deployed through a supply‑chain attack https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-chain-attack/

2023-05 Agrius Deploys Moneybird in Targeted Attacks Against Israeli Organizations https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-israeli-organizations/

Reports & References 1

https://assets.sentinelone.com/sentinellabs/evol-agrius

ETDA Profile

Agrius

Origin

Iran

First Seen 2020

Motivation

Information theft and espionage Sabotage and destruction

View on ETDA APT Groups ↗