Magic Hound - G0059

Created: 2018-01-16T16:13:52.465Z

Modified: 2023-01-13T21:18:18.077Z

Contributors: Anastasios Pingios,Bryan Lee,Daniyal Naeem, BT Security

Aliases

Magic Hound,TA453,COBALT ILLUSION,Charming Kitten,ITG18,Phosphorus,Newscaster,APT35

Description

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)

Techniques Used

Magic Hound has used base64-encoded commands.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,SaaS,Network|T1098|Account Manipulation|

Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

Magic Hound has copied tools within a compromised network using RDP.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|