Pink Sandstorm
No sourced public emblem in this profile.
reference profile · reported nexus: IR (not nationality)
Agonizing Serpens is an Iranian-linked APT group that has been active since 2020. They are known for their destructive wiper and fake-ransomware attacks, primarily targeting Israeli organizations in the education and technology sectors. The group has strong connections to Iran's Ministry of Intelligence and Security and has been observed using various tools and techniques to bypass security measures. They aim to steal sensitive information, including PII and intellectual property, and inflict damage by wiping endpoints.
Source-reported aliases: AMERICIUM, BlackShadow, DEV-0022, Agrius, Agonizing Serpens, UNC2428, Black Shadow, SPECTRAL KITTEN. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
https://therecord.media/iran-linked-hackers-target-israel-education-tech-sectors
https://www.enigmasoftware.com/moneybirdransomware-removal/
https://services.google.com/fh/files/misc/m-trends-2025-en.pdf