Threat intelligence / Group

Magic Hound

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

92 recorded

Relationships

revoked-by

from Charming Kitten

Group

uses

to Additional Email Delegate Permissions

Technique

uses

to Additional Local or Domain Groups

Technique

uses

to Application Layer Protocol

Technique

uses

to Archive via Utility

Technique

uses

to Bidirectional Communication

Technique

uses

to CharmPower

Malware

uses

to Clear Command History

Technique

uses

to Command Obfuscation

Technique

uses

to Credentials

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Data from Local System

Technique

uses

to Default Accounts

Technique

uses

to Determine Physical Locations

Technique

uses

to Disable or Modify Tools

Technique

uses

to Disable or Modify Windows Event Log

Technique

uses

to Domain Accounts

Technique

uses

to Domains

Technique

uses

to Domains

Technique

uses

to Domain Trust Discovery

Technique

uses

to DownPaper

Malware

uses

to Drive-by Compromise

Technique

uses

to Email Account

Technique

uses

to Email Accounts

Technique

uses

to Email Accounts

Technique

uses

to Email Addresses

Technique

uses

to Email Collection

Technique

uses

to Encrypted Channel

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over Web Service

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to FRP

Tool

uses

to Gather Victim Identity Information

Technique

uses

to Hidden Window

Technique

uses

to Impacket

Tool

uses

to Ingress Tool Transfer

Technique

uses

to Internet Connection Discovery

Technique

uses

to IP Addresses

Technique

uses

to ipconfig

Tool

uses

to Keylogging

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Local Email Collection

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Masquerade Account Name

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mimikatz

Tool

uses

to Modify Registry

Technique

uses

to Net

Tool

uses

to netsh

Tool

uses

to Network Service Discovery

Technique

uses

to Non-Standard Port

Technique

uses

to Ping

Tool

uses

to PowerLess

Malware

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Protocol Tunneling

Technique

uses

to Proxy

Technique

uses

to PsExec

Tool

uses

to Pupy

Tool

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote Email Collection

Technique

uses

to Remote System Discovery

Technique

uses

to Rundll32

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Social Media Accounts

Technique

uses

to Software

Technique

uses

to Spearphishing Link

Technique

uses

to Spearphishing Link

Technique

uses

to Spearphishing via Service

Technique

uses

to Systeminfo

Tool

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Tool

Technique

uses

to Visual Basic

Technique

uses

to Vulnerability Scanning

Technique

uses

to Web Protocols

Technique

uses

to Web Services

Technique

uses

to Web Shell

Technique

uses

to Wi-Fi Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Host Firewall

Technique

uses

to Windows Management Instrumentation

Technique

26 external

References

mitre-attack

G0059

open

Charming Kitten

—

APT35

—

ITG18

—

Phosphorus

—

Mint Sandstorm

—

TA453

—

COBALT ILLUSION

—

Magic Hound

—

Microsoft Phosphorus Mar 2019

https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/

open

Microsoft Phosphorus Oct 2020

https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/

open

Certfa Charming Kitten January 2021

https://blog.certfa.com/posts/charming-kitten-christmas-gift/

open

Check Point APT35 CharmPower January 2022

https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/

open

ClearSky Charming Kitten Dec 2017

http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf

open

ClearSky Kittens Back 2 Oct 2019

https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2-1.pdf

open

ClearSky Kittens Back 3 August 2020

https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf

open

Eweek Newscaster and Charming Kitten May 2014

https://www.eweek.com/security/newscaster-threat-uses-social-media-for-intelligence-gathering

open

Unit 42 Magic Hound Feb 2017

https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/

open

Newscaster

—

FireEye APT35 2018

https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

Proofpoint TA453 July2021

https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453

open

Proofpoint TA453 March 2021

https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential

open

Secureworks COBALT ILLUSION Threat Profile

https://www.secureworks.com/research/threat-profiles/cobalt-illusion

open

US District Court of DC Phosphorus Complaint 2019

https://noticeofpleadings.com/phosphorus/files/Complaint.pdf

open

IBM ITG18 2020

https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/

open