Magic Hound

Overview

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.

Targets

Defense · Diplomacy · Government · Military · Technology

Regions

Iraq · Israel · Saudi Arabia · U.S. government/defense sector websites · United Kingdom

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190
• Custom malware/implant development — ATT&CK: 3 attributed custom malware families

TTPs — 78 techniques across 14 tactics

Tools & malware (13)

Net · Impacket · Ping · CharmPower · FRP · Mimikatz · Systeminfo · ipconfig · netsh · PowerLess · Pupy · DownPaper · PsExec

Reporting (3)

• How Microsoft names threat actors — Microsoft
• APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit — Check Point
• Operation SpoofedScholars: A Conversation with TA453 — Miller, J. et al