Magic Hound

G0059

APT / State-SponsoredIranActive

Also known as: TA453 · COBALT ILLUSION · Charming Kitten · ITG18 · Phosphorus · Newscaster · APT35 · Mint Sandstorm

Active Since

2018-01-16

Overview

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.

MITRE ATT&CK — 50 techniques

Navigator →

T1056.001KeyloggingCollection

T1567Exfiltration Over Web ServiceExfiltration

T1589.001CredentialsReconnaissance

T1547.001Registry Run Keys / Startup FolderPersistence

T1059.001PowerShellExecution

T1016.002Wi-Fi DiscoveryDiscovery

T1588.002ToolResource Development

T1584.001DomainsResource Development

T1059.003Windows Command ShellExecution

T1572Protocol TunnelingCommand and Control

T1585.002Email AccountsResource Development

T1591.001Determine Physical LocationsReconnaissance

T1071Application Layer ProtocolCommand and Control

T1071.001Web ProtocolsCommand and Control

T1486Data Encrypted for ImpactImpact

T1016.001Internet Connection DiscoveryDiscovery

T1586.002Email AccountsResource Development

T1053.005Scheduled TaskExecution

T1592.002SoftwareReconnaissance

T1021.001Remote Desktop ProtocolLateral Movement

T1105Ingress Tool TransferCommand and Control

T1190Exploit Public-Facing ApplicationInitial Access

T1204.002Malicious FileExecution

T1218.011Rundll32Stealth

T1027.010Command ObfuscationStealth

T1046Network Service DiscoveryDiscovery

T1590.005IP AddressesReconnaissance

T1113Screen CaptureCollection

T1573Encrypted ChannelCommand and Control

T1059.005Visual BasicExecution

T1685.001Disable or Modify Windows Event LogDefense Impairment

T1595.002Vulnerability ScanningReconnaissance

T1036.010Masquerade Account NameStealth

T1589.002Email AddressesReconnaissance

T1204.001Malicious LinkExecution

T1102.002Bidirectional CommunicationCommand and Control

T1033System Owner/User DiscoveryDiscovery

T1098.002Additional Email Delegate PermissionsPersistence

T1070.004File DeletionStealth

T1027.013Encrypted/Encoded FileStealth

T1566.002Spearphishing LinkInitial Access

T1078.001Default AccountsStealth

T1083File and Directory DiscoveryDiscovery

T1016System Network Configuration DiscoveryDiscovery

T1036.005Match Legitimate Resource Name or LocationStealth

T1098.007Additional Local or Domain GroupsPersistence

T1598.003Spearphishing LinkReconnaissance

T1049System Network Connections DiscoveryDiscovery

T1114Email CollectionCollection

T1003.001LSASS MemoryCredential Access

Malware & Tools — 13

NetToolWindows

ImpacketToolLinux / macOS / Windows

PingTool

CharmPowerMalwareWindows

FRPToolLinux / macOS / Windows

MimikatzToolWindows

SysteminfoTool

ipconfigTool

netshToolWindows

PowerLessMalware

References

https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/ →https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/ →https://blog.certfa.com/posts/charming-kitten-christmas-gift/ →https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/ →http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf →https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2-1.pdf →https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf →https://www.eweek.com/security/newscaster-threat-uses-social-media-for-intelligence-gathering →https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/ →https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf →

← Back to Threat Actors