Threat intelligence
- Suspected origin
- Iran
- First seen
- 2012-01-01 00:00:00
- Motivation
- Information theft and espionage
- Targeted sectors
- Defense, Education, Energy, Financial, Government, Healthcare, IT, Manufacturing, NGOs, Oil and gas, Technology, Telecommunications
- TLP
- WHITE
Magic Hound is an Iranian-sponsored threat group operating primarily in the Middle East that dates back as early as 2014. The group behind the campaign has primarily targeted organizations in the energy, government, and technology sectors that are either based or have business interests in Saudi Arabia.
Magic Hound has 2 subgroups:
1. Subgroup: DEV-0270, Nemesis Kitten
2. Subgroup: TA455, Smoke Sandstorm
This group appears to be the evolvement of Cutting Kitten, TG-2889.
There is some infrastructure overlap with Rocket Kitten, Newscaster, NewsBeef, ITG18 and APT 42.
Also known as
Agent SerpensAPT 35APT35Ballistic BobcatCharming KittenCharmingCypressCobalt IllusionCobalt MirageEducated ManticoreG0058G0059ITG18Magic HoundMint SandstormNewscasterPhosphorusTA453Tarh AndishanTEMP.BeanieTimberwormTunnelVisionUNC788Yellow Garuda
Vulnerabilities exploited
Tooling and malware
CharmPowerDownPaperPowerLessFRPImpacketipconfigMimikatzNetnetshPingPsExecPupySysteminfo
MITRE ATT&CK techniques
T1005 Data from Local SystemT1113 Screen CaptureT1114 Email CollectionT1071 Application Layer ProtocolT1090 ProxyT1105 Ingress Tool TransferT1571 Non-Standard PortT1572 Protocol TunnelingT1573 Encrypted ChannelT1112 Modify RegistryT1685 Disable or Modify ToolsT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1482 Domain Trust DiscoveryT1047 Windows Management InstrumentationT1567 Exfiltration Over Web ServiceT1486 Data Encrypted for ImpactT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1570 Lateral Tool TransferT1589 Gather Victim Identity Information
Coverage 2
threat-intel
Iranian state-sponsored hacking group Nimbus Manticore (linked to Charming Kitten) has expanded its toolset with a TWOSTROKE-like backdoor and SSH tunneling utility, furthering its espionage activities targeting defense,…
threat-intel
The Iranian APT group, known as Nimbus Manticore, has been aggressively updating its tactics and tools to target aviation and software companies globally. The group, linked to Charming Kitten and the IRGC, is employing…
