Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Magic Hound has used Plink to tunnel RDP over SSH.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1078.001|Default Accounts|

Magic Hound enabled and used the default system managed account, DefaultAccount, via

Magic Hound has used

Ping for discovery on targeted networks.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|PRE|T1592.002|Software|

Magic Hound has captured the user-agent strings from visitors to their phishing sites.(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|PRE|T1590.005|IP Addresses|

Magic Hound has captured the IP addresses of visitors to their phishing sites.(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567|Exfiltration Over Web Service|

Magic Hound has used the Telegram API

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Magic Hound has used quser.exe to identify existing RDP connections.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|