Skip to content

G0059 Magic Hound

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted U.S. and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.10731311

Item Value
ID G0059
Associated Names TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35
Version 4.1
Created 16 January 2018
Last Modified 17 April 2022
Navigation Layer View In ATT&CK® Navigator

Associated Group Descriptions

Name Description
TA453 12114
COBALT ILLUSION 13
Charming Kitten 5867124
ITG18 15
Phosphorus 12143124
Newscaster Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the older attack campaign called Newscaster (aka Newscasters).910
APT35 1034

Techniques Used

Domain ID Name Use
enterprise T1098 Account Manipulation -
enterprise T1098.002 Additional Email Delegate Permissions Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim’s OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.10
enterprise T1583 Acquire Infrastructure -
enterprise T1583.001 Domains Magic Hound has registered fraudulent domains such as “mail-newyorker.com” and “news12.com.recover-session-service.site” to target specific victims with phishing attacks.3
enterprise T1583.006 Web Services Magic Hound has acquired Amazon S3 buckets to use in C2.4
enterprise T1595 Active Scanning -
enterprise T1595.002 Vulnerability Scanning Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to Log4j (CVE-2021-44228).4
enterprise T1071 Application Layer Protocol Magic Hound malware has used IRC for C2.9
enterprise T1071.001 Web Protocols Magic Hound malware has used HTTP for C2.9
enterprise T1560 Archive Collected Data -
enterprise T1560.001 Archive via Utility Magic Hound has used RAR to stage and compress local folders.10
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.001 Registry Run Keys / Startup Folder Magic Hound malware has used Registry Run keys to establish persistence.9
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.001 PowerShell Magic Hound has used PowerShell for execution and privilege escalation.910
enterprise T1059.003 Windows Command Shell Magic Hound has used the command-line interface.9
enterprise T1059.005 Visual Basic Magic Hound malware has used VBS scripts for execution.9
enterprise T1586 Compromise Accounts -
enterprise T1586.002 Email Accounts Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.15
enterprise T1584 Compromise Infrastructure -
enterprise T1584.001 Domains Magic Hound has used compromised domains to host links targeted to specific phishing victims.7113
enterprise T1189 Drive-by Compromise Magic Hound has conducted watering-hole attacks through media and magazine websites.7
enterprise T1114 Email Collection Magic Hound has compromised email credentials in order to steal sensitive data.3
enterprise T1114.001 Local Email Collection Magic Hound has collected .PST archives.10
enterprise T1585 Establish Accounts -
enterprise T1585.001 Social Media Accounts Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them–through messages and voice communications–to open malicious links.7
enterprise T1585.002 Email Accounts Magic Hound has established email accounts using fake personas for spearphishing operations.1512
enterprise T1190 Exploit Public-Facing Application Magic Hound has used open-source JNDI exploit kits to leverage the Log4j (CVE-2021-44228) vulnerability.4
enterprise T1083 File and Directory Discovery Magic Hound malware can list a victim’s logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory’s contents.9
enterprise T1589 Gather Victim Identity Information Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.11
enterprise T1589.001 Credentials Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites.15
enterprise T1589.002 Email Addresses Magic Hound has acquired the personal email addresses of some individuals they intend to target.11
enterprise T1564 Hide Artifacts -
enterprise T1564.003 Hidden Window Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.9
enterprise T1070 Indicator Removal on Host -
enterprise T1070.004 File Deletion Magic Hound has deleted and overwrote files to cover tracks.910
enterprise T1105 Ingress Tool Transfer Magic Hound has downloaded additional code and files from servers onto victims.9
enterprise T1056 Input Capture -
enterprise T1056.001 Keylogging Magic Hound malware is capable of keylogging.9
enterprise T1571 Non-Standard Port Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.9
enterprise T1027 Obfuscated Files or Information Magic Hound malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.9
enterprise T1588 Obtain Capabilities -
enterprise T1588.002 Tool Magic Hound has obtained and used open-source penetration testing tools like Havij, sqlmap, Metasploit, and Mimikatz.16104
enterprise T1003 OS Credential Dumping -
enterprise T1003.001 LSASS Memory Magic Hound stole domain credentials from Microsoft Active Directory Domain Controller and leveraged Mimikatz.10
enterprise T1566 Phishing -
enterprise T1566.002 Spearphishing Link Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.1773
enterprise T1566.003 Spearphishing via Service Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.1817
enterprise T1598 Phishing for Information -
enterprise T1598.003 Spearphishing Link Magic Hound has used SMS and email messages with links designed to steal credentials.371211
enterprise T1057 Process Discovery Magic Hound malware can list running processes.9
enterprise T1113 Screen Capture Magic Hound malware can take a screenshot and upload the file to its C2 server.9
enterprise T1082 System Information Discovery Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.9
enterprise T1016 System Network Configuration Discovery Magic Hound malware gathers the victim’s local IP address, MAC address, and external IP address.9
enterprise T1033 System Owner/User Discovery Magic Hound malware has obtained the victim username and sent it to the C2 server.9
enterprise T1204 User Execution -
enterprise T1204.001 Malicious Link Magic Hound has attempted to lure victims into opening malicious links embedded in emails.73
enterprise T1204.002 Malicious File Magic Hound has attempted to lure victims into opening malicious email attachments.7
enterprise T1102 Web Service -
enterprise T1102.002 Bidirectional Communication Magic Hound malware can use a SOAP Web service to communicate with its C2 server.9

Software

ID Name References Techniques
S0674 CharmPower - Web Protocols:Application Layer Protocol PowerShell:Command and Scripting Interpreter Windows Command Shell:Command and Scripting Interpreter Standard Encoding:Data Encoding Data from Local System Deobfuscate/Decode Files or Information Symmetric Cryptography:Encrypted Channel Exfiltration Over Unencrypted Non-C2 Protocol:Exfiltration Over Alternative Protocol Exfiltration Over C2 Channel Fallback Channels File and Directory Discovery File Deletion:Indicator Removal on Host Ingress Tool Transfer Modify Registry Process Discovery Query Registry Screen Capture Software Discovery System Information Discovery System Network Configuration Discovery System Network Connections Discovery Web Service Dead Drop Resolver:Web Service Windows Management Instrumentation
S0186 DownPaper - Web Protocols:Application Layer Protocol Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Windows Command Shell:Command and Scripting Interpreter PowerShell:Command and Scripting Interpreter Query Registry System Information Discovery System Owner/User Discovery
S0002 Mimikatz - SID-History Injection:Access Token Manipulation Account Manipulation Security Support Provider:Boot or Logon Autostart Execution Credentials from Password Stores Credentials from Web Browsers:Credentials from Password Stores Windows Credential Manager:Credentials from Password Stores LSA Secrets:OS Credential Dumping DCSync:OS Credential Dumping Security Account Manager:OS Credential Dumping LSASS Memory:OS Credential Dumping Rogue Domain Controller Silver Ticket:Steal or Forge Kerberos Tickets Golden Ticket:Steal or Forge Kerberos Tickets Private Keys:Unsecured Credentials Pass the Hash:Use Alternate Authentication Material Pass the Ticket:Use Alternate Authentication Material
S0029 PsExec - Domain Account:Create Account Windows Service:Create or Modify System Process Lateral Tool Transfer SMB/Windows Admin Shares:Remote Services Service Execution:System Services
S0192 Pupy - Bypass User Account Control:Abuse Elevation Control Mechanism Token Impersonation/Theft:Access Token Manipulation Local Account:Account Discovery LLMNR/NBT-NS Poisoning and SMB Relay:Adversary-in-the-Middle Web Protocols:Application Layer Protocol Archive via Utility:Archive Collected Data Audio Capture Registry Run Keys / Startup Folder:Boot or Logon Autostart Execution Python:Command and Scripting Interpreter PowerShell:Command and Scripting Interpreter Local Account:Create Account Domain Account:Create Account Systemd Service:Create or Modify System Process Credentials from Web Browsers:Credentials from Password Stores Credentials from Password Stores Local Email Collection:Email Collection Asymmetric Cryptography:Encrypted Channel Exfiltration Over C2 Channel File and Directory Discovery Clear Windows Event Logs:Indicator Removal on Host Ingress Tool Transfer Keylogging:Input Capture Network Service Discovery Network Share Discovery Cached Domain Credentials:OS Credential Dumping LSA Secrets:OS Credential Dumping LSASS Memory:OS Credential Dumping Process Discovery Dynamic-link Library Injection:Process Injection Remote Desktop Protocol:Remote Services Screen Capture System Information Discovery System Network Configuration Discovery System Network Connections Discovery System Owner/User Discovery Service Execution:System Services Credentials In Files:Unsecured Credentials Pass the Ticket:Use Alternate Authentication Material Video Capture System Checks:Virtualization/Sandbox Evasion

References


  1. Burt, T. (2019, March 27). New steps to protect customers from hacking. Retrieved May 27, 2020. 

  2. Burt, T. (2020, October 28). Cyberattacks target international conference attendees. Retrieved March 8, 2021. 

  3. Certfa Labs. (2021, January 8). Charming Kitten’s Christmas Gift. Retrieved May 3, 2021. 

  4. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022. 

  5. ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017. 

  6. ClearSky Research Team. (2019, October 1). The Kittens Are Back in Town2 - Charming Kitten Campaign KeepsGoing on, Using New Impersonation Methods. Retrieved April 21, 2021. 

  7. ClearSky Research Team. (2020, August 1). The Kittens Are Back in Town 3 - Charming Kitten Campaign Evolved and Deploying Spear-Phishing link by WhatsApp. Retrieved April 21, 2021. 

  8. Kerner, S. (2014, May 29). Newscaster Threat Uses Social Media for Intelligence Gathering. Retrieved April 14, 2021. 

  9. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017. 

  10. Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018. 

  11. Miller, J. et al. (2021, July 13). Operation SpoofedScholars: A Conversation with TA453. Retrieved August 18, 2021. 

  12. Miller, J. et al. (2021, March 30). BadBlood: TA453 Targets US and Israeli Medical Research Personnel in Credential Phishing Campaigns. Retrieved May 4, 2021. 

  13. Secureworks. (n.d.). COBALT ILLUSION Threat Profile. Retrieved April 14, 2021. 

  14. US District Court of DC. (2019, March 14). MICROSOFT CORPORATION v. JOHN DOES 1-2, CONTROLLING A COMPUTER NETWORK AND THEREBY INJURING PLAINTIFF AND ITS CUSTOMERS. Retrieved March 8, 2021. 

  15. Wikoff, A. Emerson, R. (2020, July 16). New Research Exposes Iranian Threat Group Operations. Retrieved March 8, 2021. 

  16. Check Point Software Technologies. (2015). ROCKET KITTEN: A CAMPAIGN WITH 9 LIVES. Retrieved March 16, 2018. 

  17. Counter Threat Unit Research Team. (2017, February 15). Iranian PupyRAT Bites Middle Eastern Organizations. Retrieved December 27, 2017. 

  18. Counter Threat Unit Research Team. (2017, July 27). The Curious Case of Mia Ash: Fake Persona Lures Middle Eastern Targets. Retrieved February 26, 2018. 

Back to top