- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, Islamic Revolutionary Guard Corps (IRGC)
- Agency named
- Islamic Revolutionary Guard Corps
- Motivation
- Espionage; Financial gain; Information theft and espionage
- Seen
- 2011–2026
- Status
- Active
- ATT&CK
- G0059 · 78 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0030 · magic-hound
IranWhat it is
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Charming Kitten, Rocket Kitten, DEV-0270, Nemesis Kitten, Magic Hound, APT 35, Cobalt Illusion, Charming Kitten, Nemesis Kitten
- IBM X-Force
- ITG18
- Mandiant
- APT35, APT 35, TEMP.Beanie, UNC788
- Microsoft
- DEV-0270, Mint Sandstorm, Storm-0270
- MITRE ATT&CK
- G0059
- Proofpoint
- TA453
- PwC
- White Phosphorous
- Secureworks
- COBALT ILLUSION
- Talos and others
- Group 83
- Operations
- Operation “BadBlood”, Operation “Newscaster”, Operation “Sponsoring Access”, Operation “SpoofedScholars”, Operation “Thamar Reservoir”, Operation “Woolen-GoldFish”
- Other names
- Educated Manticore, Agent Serpens, Ballistic Bobcat, Charming Kitten (Crowdstrike), CharmingCypress, Cobalt Mirage, Damselfly, DireFate, Greycatfish, iKittens, Iridium Group, Lord Nemesis, Mint Sandstorm (Microsoft), NewsBeef, Newscaster, Newscaster Team, Parastoo, Phosphorus, RICH ION, Rocket Kitten, Newscaster, NewsBeef, Saffron Rose, Tarh Andishan, Timberworm, TunnelVision, Yellow Dev 23, Yellow Dev 24, Yellow Garuda
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- MicrosoftIran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Afghanistan, Algeria, Belgium, Brazil, Canada, China, Egypt, France, Germany, India, Iran, Iraq, Israel, Japan, Jordan, Kazakhstan, Kuwait, Morocco, Pakistan, Romania, Russia, Saudi Arabia, Spain, Syria, Türkiye, U.S. government/defense sector websites, Ukraine, United Arab Emirates, United Kingdom, United States, Venezuela, Yemen
- Sectors
- Academia, Construction, Defense, Diplomacy, Education, Embassies, Energy, Entertainment, Financial, Government, Government, Administration, Healthcare, IT, Manufacturing, Media, Military, NGOs, Oil and gas, Pharmaceutical, Technology, Telecommunications
Tools
The tools and malware families the sources tie to it.
- Back Orifice
- Back Orifice 2000
- Backdoor.Oldrea
- CharmPower
- DownPaper
- FRP
- Impacket
- Living off the Land
- Mimikatz
- Net
- POWERSOURCE
- POWERSTATS
- Parasite-HTTP-RAT
- Ping
- Power Loader
- PowerDuke
- PowerLess
- PowerRAT
- PsExec
- Pupy
- Systeminfo
- WmiExec
- ipconfig
- netsh
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de