Fire Ant

Pink Sandstorm

CyberSIXT coverage, Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®

AMERICIUM

Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®

Agonizing Serpens

Malpedia, MISP Galaxy, MITRE ATT&CK®

Agrius

Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®

BlackShadow

Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®

DEV-0022

Malpedia, MISP Galaxy

SPECTRAL KITTEN

Malpedia, Microsoft, MISP Galaxy

UNC2428

Malpedia, MISP Galaxy

Origin

Iran Microsoft · Pink Sandstorm, MISP Galaxy

Category

State Microsoft · Pink Sandstorm

From MITRE ATT&CK® · G1030

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK

1. 31 AugChinese Fire Ant Hackers Hijack Cisco Routers to Steal CredentialsSecurity Affairs
2. 31 AugFire Ant hackers exploit Cisco router flaws to steal credentialsThe Hacker News
3. 31 AugFire Ant Threat Actor Targets Trusted InfrastructureSecurityOnline
4. 31 MarIran Deploys 'Pseudo-Ransomware,' Revives Pay2Key OperationsDark Reading
5. 9 FebChina-Linked UNC3886 Targets Singapore Telecom Sector in Cyber Espionage CampaignThe Hacker News · first in our coverage

• Agrius Deploys Moneybird in Targeted Attacks Against Israeli OrganizationsCheck Point · 16 Apr
• Uncovering MosesStaff techniques: Ideology over MoneyCheck Point · 7 Apr
• Server Software Component: Web Shell, Sub-technique T1505.003 - EnterpriseMITRE ATT&CK · 6 Apr

• MITRE ATT&CK®Agrius (G1030)
• MicrosoftPink Sandstorm
• MalpediaPink Sandstorm
• Unit 42Agonizing Serpens
• ETDAAgrius