Skip to content

Magic Hound

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.

ATT&CK ID: G0059
Origin: Iran
Weather family: Sandstorm
Techniques: 58
Tools: 13

Also tracked as TA453 · COBALT ILLUSION · Charming Kitten · ITG18 · Phosphorus · Newscaster · APT35 · Mint Sandstorm

Vulnerabilities it has exploited

Techniques

Reconnaissance

Gather Victim Identity Information Gather Victim Network Information Gather Victim Org Information Gather Victim Host Information Active Scanning Phishing for Information

Resource Development

Acquire Infrastructure Compromise Infrastructure Establish Accounts Compromise Accounts Obtain Capabilities

Initial Access

Valid Accounts Drive-by Compromise Exploit Public-Facing Application Phishing

Execution

Windows Management Instrumentation Scheduled Task/Job Command and Scripting Interpreter User Execution

Persistence

Scheduled Task/Job Valid Accounts Account Manipulation Modify Registry Create Account Server Software Component Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Valid Accounts Account Manipulation Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Indicator Removal Valid Accounts System Binary Proxy Execution Hide Artifacts

Defense Impairment

Modify Registry Disable or Modify Tools Disable or Modify System Firewall

Credential Access

OS Credential Dumping Input Capture

Discovery

System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery System Information Discovery File and Directory Discovery Account Discovery Domain Trust Discovery

Lateral Movement

Remote Services Lateral Tool Transfer

Collection

Data from Local System Input Capture Screen Capture Email Collection Archive Collected Data

Command and Control

Application Layer Protocol Proxy Web Service Ingress Tool Transfer Non-Standard Port Protocol Tunneling Encrypted Channel

Exfiltration

Exfiltration Over Web Service

Impact

Data Encrypted for Impact

Software

CharmPower · DownPaper · FRP · Impacket · Mimikatz · Net · Ping · PowerLess · PsExec · Pupy · Systeminfo · ipconfig · netsh

MITRE ATT&CK All threat actors