Agonizing Serpens is an Iranian-linked APT group that has been active since 2020. They are known for their destructive wiper and fake-ransomware attacks, primarily targeting Israeli organizations in the education and technology sectors. The group has strong connections to Iran's Ministry of Intelligence and Security and has been observed using various tools and techniques to bypass security measures. They aim to steal sensitive information, including PII and intellectual property, and inflict damage by wiping endpoints.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | AMERICIUM |
| OSINT | BlackShadow |
| OSINT | DEV-0022 |
| OSINT | Agrius |
| OSINT | Agonizing Serpens |
| OSINT | UNC2428 |
| OSINT | Black Shadow |
| OSINT | SPECTRAL KITTEN |
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Pink Sandstorm, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Pink Sandstorm. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.