# Pink Sandstorm Agrius

Adversary-emulation profile for Pink Sandstorm (G1030 / Agrius / Agonizing Serpens /...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill pink-sandstorm-agrius -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill pink-sandstorm-agrius -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill pink-sandstorm-agrius -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill pink-sandstorm-agrius -g -a gemini-cli -y`

## Description

Adversary-emulation profile for Pink Sandstorm (G1030 / Agrius / Agonizing Serpens / AMERICIUM / BlackShadow / DEV-0227), Iran's MOIS-linked destructive wiper and pseudo-ransomware operator.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Pink Sandstorm (Agrius, Agonizing Serpens, BlackShadow), Adversary Emulation Profile

Pink Sandstorm (MITRE ATT&CK **G1030**) is an Iranian threat actor active since at least 2020, linked to Iran's Ministry of Intelligence and Security (MOIS). The group is notable for a series of **destructive wiper and pseudo-ransomware operations** primarily targeting Israeli organizations, with secondary operations against targets in the UAE, South Africa, and Hong Kong. Agrius deliberately **disguises destructive wiper attacks as ransomware**, using extortion personas (BlackShadow, Moneybird, n3tw0rm) to mask its true intent, strategic disruption and data destruction aligned with Iranian state interests. The group operates a lineage of custom .NET and C++ wipers (Apostle → Fantasy → MultiLayer → BFG Agonizer) alongside the IPsec Helper backdoor, ASPXSpy web shells, and public offensive tools (Mimikatz, Plink, NBTscan). Since the October 2023 Israel-Hamas war, Microsoft has observed Pink Sandstorm collaborating with Hezbollah cyber units and escalating hack-and-leak operations against Israeli targets.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/pink-sandstorm/SKILL.md