MITRE ATT&CKgroup
G0059 Magic Hound
- Domain
- enterprise
- Aliases
- TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm
- Version
- 6.1
- Created
- 2018-01-16
Description
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.
Related
Uses · MITRE ATT&CK (91)
- T1685 Disable or Modify Tools technique
- T1685.001 Disable or Modify Windows Event Log sub-technique
- T1686.003 Windows Host Firewall sub-technique
- T1036.010 Masquerade Account Name sub-technique
- T1098.007 Additional Local or Domain Groups sub-technique
- S1144 FRP software (tool)
- T1027.013 Encrypted/Encoded File sub-technique
- T1016.002 Wi-Fi Discovery sub-technique
- T1027.010 Command Obfuscation sub-technique
- S1012 PowerLess software (malware)
- S0674 CharmPower software (malware)
- T1016.001 Internet Connection Discovery sub-technique
- T1589 Gather Victim Identity Information technique
- T1589.001 Credentials sub-technique
- T1589.002 Email Addresses sub-technique
- T1590.005 IP Addresses sub-technique
- T1591.001 Determine Physical Locations sub-technique
- T1592.002 Software sub-technique
- T1595.002 Vulnerability Scanning sub-technique
- T1598.003 Spearphishing Link sub-technique
- T1583.006 Web Services sub-technique
- T1584.001 Domains sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1585.002 Email Accounts sub-technique
- T1586.002 Email Accounts sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1573 Encrypted Channel technique
- T1071.001 Web Protocols sub-technique
- T1572 Protocol Tunneling technique
References
- https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/ Microsoft Phosphorus Mar 2019
- https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/ Microsoft Phosphorus Oct 2020
- https://blog.certfa.com/posts/charming-kitten-christmas-gift/ Certfa Charming Kitten January 2021
- https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/ Check Point APT35 CharmPower January 2022
- http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf ClearSky Charming Kitten Dec 2017
- https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2-1.pdf ClearSky Kittens Back 2 Oct 2019
- https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf ClearSky Kittens Back 3 August 2020
- https://www.eweek.com/security/newscaster-threat-uses-social-media-for-intelligence-gathering Eweek Newscaster and Charming Kitten May 2014
- https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/ Unit 42 Magic Hound Feb 2017
- https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf FireEye APT35 2018
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453 Proofpoint TA453 July2021
- https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential Proofpoint TA453 March 2021
- https://www.secureworks.com/research/threat-profiles/cobalt-illusion Secureworks COBALT ILLUSION Threat Profile
- https://noticeofpleadings.com/phosphorus/files/Complaint.pdf US District Court of DC Phosphorus Complaint 2019
- https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/ IBM ITG18 2020