Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.12345
- FireEye APT35 2018
- ClearSky Kittens Back 3 August 2020
- Certfa Charming Kitten January 2021
- Secureworks COBALT ILLUSION Threat Profile
- Proofpoint TA453 July2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Magic Hound | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TA453 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | COBALT ILLUSION | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Charming Kitten | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | ITG18 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Phosphorus | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Newscaster | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | APT35 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Mint Sandstorm | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1592.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1482 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1016.002 | Wi-Fi Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1027.010 | Command Obfuscation | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1033 | System Owner/User Discovery | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1036.010 | Masquerade Account Name | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1071 | Application Layer Protocol | — |
| T1071.001 | Web Protocols | — |
| T1078.001 | Default Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.003 | Email Account | — |
| T1090 | Proxy | — |
| T1098.002 | Additional Email Delegate Permissions | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1114 | Email Collection | — |
| T1114.001 | Local Email Collection | — |
| T1114.002 | Remote Email Collection | — |
| T1136.001 | Local Account | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.011 | Rundll32 | — |
| T1482 | Domain Trust Discovery | — |
| T1486 | Data Encrypted for Impact | — |
| T1505.003 | Web Shell | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1560.001 | Archive via Utility | — |
| T1564.003 | Hidden Window | — |
| T1566.002 | Spearphishing Link | — |
| T1566.003 | Spearphishing via Service | — |
| T1567 | Exfiltration Over Web Service | — |
| T1570 | Lateral Tool Transfer | — |
| T1571 | Non-Standard Port | — |
| T1572 | Protocol Tunneling | — |
| T1573 | Encrypted Channel | — |
| T1583.001 | Domains | — |
| T1583.006 | Web Services | — |
| T1584.001 | Domains | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.002 | Email Accounts | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1589.001 | Credentials | — |
| T1589.002 | Email Addresses | — |
| T1590.005 | IP Addresses | — |
| T1591.001 | Determine Physical Locations | — |
| T1592.002 | Software | — |
| T1595.002 | Vulnerability Scanning | — |
| T1598.003 | Spearphishing Link | — |
| T1685 | Disable or Modify Tools | — |
| T1685.001 | Disable or Modify Windows Event Log | — |
| T1686.003 | Windows Host Firewall | — |
Aliases
APT35 · Charming Kitten · COBALT ILLUSION · ITG18 · Magic Hound · Mint Sandstorm · Newscaster · Phosphorus · TA453
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.