Agrius
Associated Group Descriptions |
|
| Name | Description |
|---|---|
| BlackShadow | (Citation: CheckPoint Agrius 2023) |
| Pink Sandstorm | (Citation: Microsoft Threat Actor Naming July 2023) |
| AMERICIUM | (Citation: Microsoft Threat Actor Naming July 2023) |
| Agonizing Serpens | (Citation: Unit42 Agrius 2023) |
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1560 | .001 | Archive Collected Data: Archive via Utility |
Agrius used 7zip to archive extracted data in preparation for exfiltration.(Citation: Unit42 Agrius 2023) |
| Enterprise | T1110 | .003 | Brute Force: Password Spraying |
Agrius engaged in password spraying via SMB in victim environments.(Citation: Unit42 Agrius 2023) |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Agrius uses ASPXSpy web shells to enable follow-on command execution via |
| Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.(Citation: SentinelOne Agrius 2021) |
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
Agrius has used the folder, |
| Enterprise | T1562 | .001 | Impair Defenses: Disable or Modify Tools |
Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, |
| Enterprise | T1003 | .001 | OS Credential Dumping: LSASS Memory |
Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.(Citation: Unit42 Agrius 2023) |
| .002 | OS Credential Dumping: Security Account Manager |
Agrius dumped the SAM file on victim machines to capture credentials.(Citation: Unit42 Agrius 2023) |
||
| Enterprise | T1021 | .001 | Remote Services: Remote Desktop Protocol |
Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts.(Citation: SentinelOne Agrius 2021) Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.(Citation: Unit42 Agrius 2023) |
| Enterprise | T1505 | .003 | Server Software Component: Web Shell |
Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.(Citation: SentinelOne Agrius 2021) |
| Enterprise | T1078 | .002 | Valid Accounts: Domain Accounts |
Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.(Citation: Unit42 Agrius 2023) |
References
- Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.
- Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
- Marc Salinas Fernandez & Jiri Vinopal. (2023, May 23). AGRIUS DEPLOYS MONEYBIRD IN TARGETED ATTACKS AGAINST ISRAELI ORGANIZATIONS. Retrieved May 21, 2024.
- Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
- Microsoft Threat Intelligence. (2023, May 2). Iran turning to cyber-enabled influence operations for greater effect. Retrieved May 21, 2024.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.