Magic Hound (G0059) | Threat Actor Index

78

Techniques

13

Toolsets

2

CVEs Referenced

1

KEV Entries

CISA Known Exploited

About Magic Hound

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.

View MITRE record ↗

Techniques by Tactic (78)

Reconnaissance

T1589 Gather Victim Identity InformationT1589.001 CredentialsT1589.002 Email AddressesT1590.005 IP AddressesT1591.001 Determine Physical LocationsT1592.002 SoftwareT1595.002 Vulnerability ScanningT1598.003 Spearphishing Link

Resource Development

T1583.001 DomainsT1583.006 Web ServicesT1584.001 DomainsT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.002 Email AccountsT1588.002 Tool

Initial Access

T1078.001 Default AccountsT1078.002 Domain AccountsT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1566.002 Spearphishing LinkT1566.003 Spearphishing via Service

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1204.001 Malicious LinkT1204.002 Malicious File

Persistence

T1053.005 Scheduled TaskT1078.001 Default AccountsT1078.002 Domain AccountsT1098.002 Additional Email Delegate PermissionsT1098.007 Additional Local or Domain GroupsT1112 Modify RegistryT1136.001 Local AccountT1505.003 Web ShellT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled TaskT1078.001 Default AccountsT1078.002 Domain AccountsT1098.002 Additional Email Delegate PermissionsT1098.007 Additional Local or Domain GroupsT1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.010 Command ObfuscationT1027.013 Encrypted/Encoded FileT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1036.010 Masquerade Account NameT1070.003 Clear Command HistoryT1070.004 File DeletionT1078.001 Default AccountsT1078.002 Domain AccountsT1218.011 Rundll32T1564.003 Hidden Window

Defence Impairment

T1112 Modify RegistryT1685 Disable or Modify ToolsT1685.001 Disable or Modify Windows Event LogT1686.003 Windows Host Firewall

Credential Access

T1003.001 LSASS MemoryT1056.001 Keylogging

Discovery

T1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1016.002 Wi-Fi DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.003 Email AccountT1482 Domain Trust Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1570 Lateral Tool Transfer

Collection

T1005 Data from Local SystemT1056.001 KeyloggingT1113 Screen CaptureT1114 Email CollectionT1114.001 Local Email CollectionT1114.002 Remote Email CollectionT1560.001 Archive via Utility

Command & Control

T1071 Application Layer ProtocolT1071.001 Web ProtocolsT1090 ProxyT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1571 Non-Standard PortT1572 Protocol TunnelingT1573 Encrypted Channel

Exfiltration

T1567 Exfiltration Over Web Service

Impact

T1486 Data Encrypted for Impact

Toolsets (13)

🐛

CharmPower S0674

Malware · Windows

🐛

DownPaper S0186

Malware · Windows

🐛

PowerLess S1012

Malware · Windows

🔧

FRP S1144

Tool · Linux, macOS, Windows

🔧

Impacket S0357

Tool · Linux, macOS, Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

Ping S0097

Tool

🔧

PsExec S0029

Tool · Windows

🔧

Pupy S0192

Tool · Linux, Windows, macOS, Android

🔧

Systeminfo S0096

Tool

🔧

ipconfig S0100

Tool

🔧

netsh S0108

Tool · Windows

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (16)

↑