Fact-checked by Grok 2 weeks ago

Agrius

''Agrius'' is a genus of hawkmoths in the family Sphingidae, comprising around 25 species found worldwide, notably including the convolvulus hawk-moth (''Agrius convolvuli'').) In cybersecurity, Agrius is the name of an Iranian-linked advanced persistent threat (APT) group active since 2020, known for destructive wiper and ransomware attacks primarily targeting Israeli organizations.^[1] In Greek mythology, Agrius (Ancient Greek: Ἄγριος, meaning "wild" or "savage") is a name attributed to several distinct figures, most notably a Giant participating in the war against the gods known as the Gigantomachy, a cannibalistic half-bear giant from Thrace punished by divine transformation, and a mortal associated with the Aetolian region.^[2]^[3]^[4] One of the most prominent Agrius was a Giant (Gigante), son of Gaia, who fought in the Gigantomachy alongside his brother Thoon; the pair were slain by the Moirai (Fates) using bronze maces during the gods' victory over the rebellious offspring of the earth goddess.^[3] This event is detailed in ancient accounts of the cosmic battle, highlighting the Fates' rare direct intervention in warfare with their unyielding instruments of destiny.^[5] Another notable Agrius appears in tales of divine retribution as a half-human, half-bear giant born in Thrace to the mortal woman Polyphonte and a bear, after she was driven to reject marriage and Aphrodite's influence by the goddess Artemis.^[4] Alongside his twin brother Oreius, this Agrius scorned both gods and humans, engaging in cannibalism by devouring strangers who entered their territory; as punishment, Zeus commanded Hermes to transform them—Agrius into a vulture, symbolizing his insatiable craving for flesh—while their mother became an owl and their servant a woodpecker.^[4] This myth, preserved in Antoninus Liberalis' Metamorphoses, underscores themes of hubris and the gods' enforcement of cosmic order through metamorphosis. In Aetolian lore, a third Agrius was a son of King Porthaon and Euryte, daughter of Hyppodamas, making him a brother to Oeneus, the famed king of Calydon who hosted the Calydonian Boar Hunt; he dwelt in Pleuron and Calydon in Aetolia.^[3]^[6] This mortal Agrius fathered several sons, including Thersites, the notorious Greek warrior from the Trojan War known for his ugliness and insolence toward superiors.^[3] His lineage connects to broader epic cycles, including the Argonautica and the Iliad, where his descendants play roles in heroic narratives. Less commonly, Agrius is also named as one of the twin sons born to Odysseus and the enchantress Circe on the island of Aeaea, alongside Latinus, though this parentage is debated in ancient traditions and may stem from variant poetic interpolations rather than core Homeric accounts. These multiple incarnations of Agrius reflect the recurring mythological motif of "wild" or savage archetypes, often embodying untamed forces subdued by divine or heroic order.

Greek Mythology

Agrius the Giant

In Greek mythology, Agrius was one of the Gigantes, a race of monstrous giants born to the earth goddess Gaia as a challenge to the authority of the Olympian gods. These beings emerged from Gaia's union with the blood of the castrated sky god Uranus, symbolizing a resurgence of primordial fury against the emerging divine order.^[7] Agrius, whose name derives from the Greek term agrios meaning "wild" or "savage," embodied this untamed essence, representing the chaotic and primal forces that sought to disrupt the structured cosmos ruled by Zeus and his kin.^[2] Agrius played a role in the Gigantomachy, the epic war between the Gigantes and the Olympians, where the giants stormed Mount Olympus in a bid to unseat the gods. This conflict, detailed in ancient accounts, pitted earth's rebellious offspring against the heavenly pantheon, with each side enlisting allies to secure victory.^[3] Alongside his brother Thoon, Agrius fought fiercely but met his end during the battle when the Moirai, the goddesses of fate, struck them down with bronze clubs. This divine intervention underscored the inexorable triumph of destiny over brute strength.^[3] The defeat of Agrius and his fellow Gigantes in the Gigantomachy symbolized the broader mythological theme of order prevailing over chaos, with the giants serving as archetypes of the wild, uncontrollable elements of nature subdued by civilized divine rule. Primary sources such as Apollodorus' Bibliotheca (1.6.2) preserve this narrative, emphasizing the Moirai's pivotal role in restoring cosmic balance.^[3] Through such tales, Agrius illustrates the eternal struggle between primordial disorder and Olympian harmony.^[8]

Agrius, Son of Porthaon

In Greek mythology, Agrius was a prince of Aetolia, identified as a son of King Porthaon of Calydon and his wife Euryte, daughter of Hippodamas.^[3] He was the brother of Oeneus, who succeeded their father as king of Calydon, as well as Alcathous, Melas, Leucippus, and the sister Sterope.^[3] According to Homer, Agrius and his brothers dwelt in the Aetolian cities of Pleuron and Calydon, suggesting Agrius's close association with Pleuron as a regional ruler. Agrius fathered six sons: Thersites, Onchestus, Prothous, Celeutor, Lycopeus, and Melanippus.^[9] These sons later overthrew their uncle Oeneus, imprisoned the aged king, and installed their father Agrius on the throne of Calydon.^[3] The family ties extended to local Aetolian legends, including the Calydonian boar hunt organized by Oeneus to honor Artemis, in which Agrius's lineage played a peripheral role through the involvement of Oeneus's descendants.^[3] One of Agrius's sons, Thersites, gained prominence in later traditions as the deformed and outspoken warrior who rails against Agamemnon in Homer's Iliad, though the epic itself does not specify his parentage. Post-Homeric accounts link Thersites explicitly to Agrius, portraying him as part of the Aetolian royal line that participated in the Trojan War.^[9] Agrius's legacy endures in the etymology of Agrinio, the largest city in ancient Aetolia (modern Agrinion), traditionally named after him as a founder or eponymous figure in the region's mythic history.^[10] This connection reflects his role as a progenitor tied to Aetolian settlements, distinct from other figures bearing the name Agrius in broader Greek lore.^[11]

Agrius, Son of Polyphonte

In Greek mythology, Agrius was a Thracian giant, the son of the mortal woman Polyphonte and a bear. Polyphonte, daughter of Hipponous, rejected marriage and Aphrodite's influence, devoting herself to Artemis instead. In punishment, Aphrodite drove her to lust after a bear in the wilderness, resulting in the birth of twin sons, Agrius and his brother Oreius (or Horeus).^[4] The brothers grew into enormous, immensely strong giants who lived in the mountains, scorning both gods and humans. They engaged in cannibalism, devouring strangers who entered their territory and even assaulting travelers. Their savagery led Zeus to order their punishment; Hermes and Ares transformed them into birds. Agrius became a vulture, symbolizing his flesh-craving nature, while Oreius turned into an eagle-owl. Their mother Polyphonte was changed into a small owl, and their servant into a woodpecker.^[4] This myth, preserved in Antoninus Liberalis' Metamorphoses (21), highlights themes of hubris, divine retribution, and the enforcement of cosmic order through metamorphosis. Agrius represents the untamed, savage forces subdued by the gods, distinct from other figures sharing his name in Greek lore.^[4]

Agrius, Son of Odysseus and Circe

In Greek mythology, Agrius is attested as one of the sons born to the hero Odysseus and the enchantress Circe following his year-long sojourn on her island of Aeaea.^[7] According to Hesiod's Theogony (lines 1011–1016), Circe, daughter of the sun god Helios, bore Odysseus three sons: Agrius, the strong and faultless Latinus, and Telegonus.^[7] This parentage blends Odysseus's mortal heroism with Circe's divine sorcery, marking Agrius as a figure of hybrid heritage in post-adventure traditions that extend beyond the canonical events of Homer's Odyssey, where no such offspring are mentioned.^[7] Later scholia on Hesiod elaborate minimally on these sons, noting their non-Homeric status and emphasizing the mythical expansion of Odysseus's lineage.^[7] Agrius and his brothers are said to have resided on Aeaea, Circe's enchanted island, embodying the liminal space between the mortal world and divine realms encountered during Odysseus's voyages.^[7] This setting underscores themes of transformation and otherworldly exile in their heritage, with Agrius representing the enduring fruits of Odysseus's detour from his homeward journey.^[7] In variant traditions, such as those linking Latinus to Italic foundations, Agrius shares in a collective role as a progenitor tied to distant western territories.^[7] Hesiod further describes Agrius and his siblings as rulers of the famed Tyrenians, located very far off in a recess of the holy islands—often associated with regions like Italy in later interpretations.^[7] This assignment positions Agrius in colonization myths, suggesting a legacy of establishing or governing remote lands that echo Odysseus's exploratory wanderings.^[7] Such narratives highlight Agrius's potential as a bridge between Greek heroic epics and etiological tales of foreign peoples.^[7] The name Agrius derives from the Ancient Greek agrios (ἄγριος), meaning "wild" or "savage," which evokes the untamed, transformative essence of his mother's magic in contrast to his father's renowned cunning.^[12] This etymology aligns with the broader symbolic undercurrents of his lineage, portraying him as an embodiment of the feral divine influences inherited from Circe.^[12]

Entomology

Genus Description

Agrius is a genus of moths belonging to the subfamily Sphinginae within the family Sphingidae and the order Lepidoptera. The genus was established by Jacob Hübner in 1819, with the type species Sphinx cingulata Fabricius, 1775.^[13] It comprises approximately 7 species, characterized by their robust morphology and ecological roles as pollinators and occasional agricultural pests.^[14] Members of the genus Agrius are large-bodied hawkmoths with stout, tapered abdomens, long narrow forewings, and a prominent proboscis adapted for feeding on nectar from deep flowers. Their wings often exhibit cryptic patterns in shades of brown and gray for camouflage, while some species display pinkish bands or spots on the abdomen. Adults are primarily crepuscular, active at dusk, and capable of sustained hovering flight.^[15] The name Agrius derives from the Greek "agrios," meaning wild or living in open fields, alluding to the untamed nature of these moths and referencing a half-bear, half-human giant from Greek mythology.^[14] The genus exhibits a pantropical distribution, with species occurring across Africa, Asia, Australia, and the Americas, though some extend into temperate regions via migration. For instance, Agrius convolvuli is known for long-distance migrations across Eurasia and Africa.^[16] Agrius moths undergo complete holometabolous metamorphosis, with larvae—commonly called hornworms—feeding voraciously on plants in the Convolvulaceae family, such as sweet potatoes (Ipomoea batatas), leading to economic significance as pests in tropical agriculture. Pupation occurs in soil chambers, and adults emerge to continue the cycle.^[17]

Notable Species

The genus Agrius includes several notable species of hawk moths in the family Sphingidae, distinguished by their robust bodies, long proboscides, and roles in pollination and agriculture. One prominent species is Agrius convolvuli, the convolvulus hawk-moth, which is a widespread migrant across Europe, Asia, Africa, and into Australia and New Zealand.^[18]^[19] This species thrives in warm, open habitats such as lowland agricultural areas and gardens, avoiding dense forests and cold montane regions.^[16] Known for its long-distance migrations, often covering thousands of kilometers, A. convolvuli serves as an important pollinator for plants with long-tubed flowers, including orchids and baobabs in open woodland habitats like those in Madagascar.^[20] Its larvae primarily feed on host plants in the Convolvulaceae family, such as bindweed (Convolvulus spp.), contributing to its ecological role while occasionally impacting crops.^[16] Another key species is Agrius cingulata, the pink-spotted hawk-moth, native to the Americas, including Central and South America, with occasional vagrants reaching southern North America.^[21] This moth is a significant agricultural pest, particularly on sweet potatoes (Ipomoea batatas), where its larvae defoliate leaves and cause substantial damage in fields, especially one month after planting.^[22] Adults feature distinctive pink bands on the abdomen and hindwings, aiding in identification, with a wingspan ranging from 95 to 120 mm.^[23] Larvae also consume other Convolvulaceae and Solanaceae plants, such as morning glories and jimsonweed, underscoring the genus's affinity for these families as hosts.^[21] Other species in the genus, such as Agrius godarti found in northern Australia, exhibit similar traits, including wingspans up to 120 mm and feeding on Convolvulaceae hosts.^[24] While Agrius species generally show variations in coloration—such as grey forewings with pinkish or yellowish suffusions on the hindwings and abdomen in A. convolvuli versus the more vivid pink spots in A. cingulata—they share a beneficial role as nocturnal pollinators despite their pest status in some crops.^[16]^[23] None of the known Agrius species are currently listed as endangered, reflecting their wide distributions and adaptability, though monitoring is recommended due to agricultural pressures.

Cybersecurity

Threat Actor Overview

Agrius is an advanced persistent threat (APT) group assessed with medium confidence to be sponsored by the Iranian government, active since at least 2020.^[25]^[26] The group, also known by aliases such as Pink Sandstorm, Agonizing Serpens, AMERICIUM, and BlackShadow, has been linked to Iran's Ministry of Intelligence and Security (MOIS).^[26]^[1] Its emergence coincides with a series of destructive cyberattacks in the Middle East, initially focused on espionage before shifting toward disruption.^[25] The name "Agrius" originates from malware samples associated with the group's operations, as identified by cybersecurity researchers.^[25] Agrius has demonstrated possible overlaps in tactics, techniques, and procedures (TTPs) with other Iranian-linked groups, such as Chafer (also known as APT39), though definitive affiliations remain unconfirmed.^[27] Unlike more espionage-oriented actors like OilRig (APT34), Agrius emphasizes destructive activities, evolving its toolkit from data-wiping malware to ransomware variants disguised as extortion tools.^[25]^[26] Agrius's strategic objectives center on espionage, data exfiltration, and operational disruption, primarily targeting Israeli entities across government, technology, education, and energy sectors, with spillover effects in other Middle Eastern countries.^[1]^[25] These campaigns often involve stealing sensitive information, such as personally identifiable information (PII) and intellectual property, for potential public exposure or leverage, while deploying wipers to cause lasting damage.^[1] The group's focus on Israeli targets aligns with broader Iranian cyber strategy amid regional tensions.^[26] As of 2024, Agrius continues to be assessed as an active threat actor, though no major new campaigns have been publicly reported in 2024 or 2025.^[26]

Operations and Techniques

Agrius's initial operations between 2020 and 2021 centered on destructive wiper attacks masquerading as ransomware, primarily targeting Israeli critical infrastructure such as water utilities and storage facilities. These campaigns deployed custom backdoors like the .NET-based IPsec Helper for establishing persistence, executing commands, and facilitating data exfiltration, often paired with credential theft mechanisms including variants of the ASPXSpy webshell for lateral movement via RDP tunneling.^[25] The group employed phishing for initial access and supply chain compromises to deliver wipers designed for system disruption, incorporating tactics such as living-off-the-land techniques with publicly available tools like ProcDump and Plink, alongside modular malware architectures that allowed for flexible payload deployment.^[25] By 2023, Agrius evolved its approach to include ransomware-like operations with the introduction of the Moneybird strain, a C++-based tool functioning as fake ransomware to enable data exfiltration without genuine ransom demands; this was often achieved through exploitation of Fortinet VPN appliances via an unassigned command injection vulnerability.^[28] Notable campaigns encompassed 2023 intrusions into Israeli higher education and technology sectors, such as Bar Ilan University, resulting in credential harvesting and data theft via webshells and tools like FileZilla; earlier espionage efforts in 2021 targeted global aerospace and telecommunications entities, with Cybereason attributing connections to Agrius through shared infrastructure and tactics involving remote access trojans like ShellClient.^[28]^[29] Additionally, a 2022 supply chain attack leveraged compromised Israeli software for the diamond industry to deploy the Fantasy wiper, affecting entities in South Africa and Hong Kong through batch scripts and DLL side-loading for payload execution.^[30] Overall, these operations resulted in significant data leaks and system disablements across targeted sectors, with no financial ransom demands observed, underscoring a focus on disruption and espionage potentially aligned with Iranian state interests.^[25]^[28]

References

[1]
GIGANTES - Giants of the Gigantomachia of Greek Mythology
AGASTHENES One of the Gigantes. AGRIOS (Agrius) A Gigante clubbed to death by the Moirai (Moirae, Fates) with maces of bronze. AIGAION (Aegaeon) A Gigante ...
[2]
APOLLODORUS, THE LIBRARY BOOK 1 - Theoi Greek Mythology
Porthaon and Euryte, daughter of Hippodamas, had sons, Oeneus, Agrius, Alcathous, Melas, Leucopeus, and a daughter Sterope, who is said to have been the mother ...
[3]
AGRIUS & OREUS (Agrios & Oreios) - Theoi Greek Mythology
Agrios (Agrius) and Oreios (Oreus) were a pair of half-bear Thrakian (Thracian) giants. They were transformed into birds--an eagle-owl and a vulture--by the ...
[4]
MOIRAE (Moirai) - The Fates, Greek Goddesses of Fate & Destiny ...
"[In the war between the gods and Gigantes (Giants) :] The Moirai (Moirae) fought with bronze maces and killed Agrios (Agrius) and Thoon." III. THE MONSTER ...
[5]
HESIOD, THEOGONY - Theoi Classical Texts Library
### Summary of Agrius in Hesiod's Theogony (Lines 1011 ff)
[6]
The Gigantomachy - Paleothea
Aug 27, 2024 · They symbolized chaos and the wild forces of nature, standing in opposition to the order represented by the Olympian gods. In art and literature ...
[7]
https://www.theoi.com/Text/HesiodTheogony.html
[8]
https://paleothea.com/titans-and-primordial-beings/the-gigantomachy/
[9]
Agrius - Hellenica World
Agrius, son of Polyphonte and a bear. The city of Agrinio, the largest city in Aetolia, took its name from Agrius. Gaius Julius Hyginus, Fabulae from The Myths ...
[10]
Agrius - Wiktionary, the free dictionary
From Ancient Greek Ἄγριος (Ágrios). ... Proper noun. Agrius m sg (genitive Agriī or Agrī); second declension. (Greek mythology) The name of various mythological ...
[11]
https://www.hellenicaworld.com/Greece/Mythology/en/Agrius.html
[12]
[PDF] Taxonomic analysis of hawk moths (Lepidoptera, Sphingidae) of ...
May 13, 2023 · Below is a description of their distribution, biology and ... Subfamily: Sphinginae. Genus: Agrius (Hübner, 1819). Species: Agrius ...
[13]
Hawk Moths - The Australian Museum
Hawk moths are medium to large, streamlined moths with large eyes, long forewings, and a large, tapered abdomen. They have a long proboscis for nectar feeding.Missing: taxonomy | Show results with:taxonomy
[14]
Genus Agrius - Indiana Nature LLC
Etymology. Agrius: Derived from the Greek word agro meaning “living in the open fields, wild, or non-domesticated.” In Greek mythology, Agrius was a half-bear, ...
[15]
Agrius convolvuli (convolvulus hawkmoth) | CABI Compendium
Phylum: Arthropoda. Subphylum: Uniramia. Class: Insecta. Order: Lepidoptera. Family: Sphingidae. Genus: Agrius. Species: Agrius convolvuli. Notes on Taxonomy ...Missing: etymology | Show results with:etymology
[16]
Agrius cingulatus (pink-spotted hawkmoth) | CABI Compendium
Distribution. A. cingulatus occurs in the tropics and suptropics of the New World, and in the Galapagos and Hawaiian Islands. As a migrant, it occurs ...Missing: pantropical | Show results with:pantropical
[17]
Agrius convolvuli Linnaeus, 1758 - GBIF
This species has a wide distribution throughout the tropical and subtropical Old World, and regularly migrates into northern Europe and northern Asia (Pittaway ...Missing: biology | Show results with:biology
[18]
Agrius convolvuli (Convolvulus hawkmoth, Sweet potato hornworm)
A migratory species [from where to where?; distance? purpose?] occurring widely in Africa, most neighbouring islands, Europe, and Asia through to Australia.
[19]
The long-tongued hawkmoth pollinator niche for native and invasive ...
Sep 7, 2015 · Agrius convolvuli has also been recorded as an important pollinator of orchids and baobabs that occur in open woodland habitats in Madagascar ( ...
[20]
Species Agrius cingulata - Pink-spotted Hawkmoth - Hodges#7771
Life Cycle Larvae feed both day and night, and pupate in a chamber in the soil. One to three generations per year; overwinters in the pupa stage.
[21]
Sweet potato hornworm: Agrius cingulata
Sep 1, 2021 · Sweet potato hornworms damage the plant by making holes on leaves one month after planting. When one plant is damaged by sweet potato hornworm, ...
[22]
Agrius cingulata - PNW Moths
Agrias cingulata is a very large moth (FW length 40–58 mm; wingspan 95–120 mm) that is a very rare stray from the south in our area.
[23]
Agrius godarti - Australian Lepidoptera
The pupa has a length of about 4.5 cms. Agrius godarti (Photo: courtesy of Todd Burrows, South Stradbroke Island, Queensland). The adult moths have fawn ...Missing: godmani | Show results with:godmani
[24]
From Wiper to Ransomware | The Evolution of Agrius - SentinelLabs
May 25, 2021 · Agrius is a new threat group that we assess with medium confidence to be of Iranian origin, engaged in both espionage and disruptive activity.
[25]
Agrius - MITRE ATT&CK®
Aug 29, 2024 · Agrius is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis ...
[26]
Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher ...
Nov 6, 2023 · Agonizing Serpens (aka Agrius) is an Iranian-linked APT group that has been active since 2020. The group is known for its destructive wiper and fake-ransomware ...Missing: MITRE ATT&CK G1030
[27]
https://www.cybereason.com/blog/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
[28]
Agrius Deploys Moneybird in Targeted Attacks Against Israeli ...
May 24, 2023 · Check Point customers remain protected from the threats described in this research. Check Point Threat Emulation provides comprehensive coverage ...
[29]
Cybereason Exposes Iranian State-Sponsored Cyber Espionage ...
Oct 6, 2021 · The investigation reveals possible connections to several Iranian state-sponsored threat actors including Chafer APT (APT39) and Agrius APT.Missing: affiliations OilRig
[30]
Iranian Hackers Deliver New 'Fantasy' Wiper to Diamond Industry ...
Dec 8, 2022 · An Iran-linked advanced persistent threat (APT) actor named Agrius is using a new wiper in attacks targeting entities in South Africa, ...