Pink Sandstorm (Agrius, Agonizing Serpens, BlackShadow), Adversary Emulation Profile

Pink Sandstorm (MITRE ATT&CK G1030) is an Iranian threat actor active since at least 2020, linked to Iran's Ministry of Intelligence and Security (MOIS). The group is notable for a series of destructive wiper and pseudo-ransomware operations primarily targeting Israeli organizations, with secondary operations against targets in the UAE, South Africa, and Hong Kong. Agrius deliberately disguises destructive wiper attacks as ransomware, using extortion personas (BlackShadow, Moneybird, n3tw0rm) to mask its true intent, strategic disruption and data destruction aligned with Iranian state interests. The group operates a lineage of custom .NET and C++ wipers (Apostle → Fantasy → MultiLayer → BFG Agonizer) alongside the IPsec Helper backdoor, ASPXSpy web shells, and public offensive tools (Mimikatz, Plink, NBTscan). Since the October 2023 Israel-Hamas war, Microsoft has observed Pink Sandstorm collaborating with Hezbollah cyber units and escalating hack-and-leak operations against Israeli targets.

Attribution & motivation