Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.12345
- FireEye APT35 2018
- ClearSky Kittens Back 3 August 2020
- Certfa Charming Kitten January 2021
- Secureworks COBALT ILLUSION Threat Profile
- Proofpoint TA453 July2021
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Magic Hound | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TA453 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | COBALT ILLUSION | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Charming Kitten | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | ITG18 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Phosphorus | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Newscaster | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | APT35 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Mint Sandstorm | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1592.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1482 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2018 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1016.002 | Wi-Fi Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1027.010 | Command Obfuscation | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1033 | System Owner/User Discovery | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1036.010 | Masquerade Account Name | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1071 | Application Layer Protocol | — |
| T1071.001 | Web Protocols | — |
| T1078.001 | Default Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.003 | Email Account | — |
| T1090 | Proxy | — |
| T1098.002 | Additional Email Delegate Permissions | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1113 | Screen Capture | — |
| T1114 | Email Collection | — |
| T1114.001 | Local Email Collection | — |
| T1114.002 | Remote Email Collection | — |
| T1136.001 | Local Account | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.011 | Rundll32 | — |
| T1482 | Domain Trust Discovery | — |
| T1486 | Data Encrypted for Impact | — |
| T1505.003 | Web Shell | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1560.001 | Archive via Utility | — |
| T1564.003 | Hidden Window | — |
| T1566.002 | Spearphishing Link | — |
| T1566.003 | Spearphishing via Service | — |
| T1567 | Exfiltration Over Web Service | — |
| T1570 | Lateral Tool Transfer | — |
| T1571 | Non-Standard Port | — |
| T1572 | Protocol Tunneling | — |
| T1573 | Encrypted Channel | — |
| T1583.001 | Domains | — |
| T1583.006 | Web Services | — |
| T1584.001 | Domains | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.002 | Email Accounts | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1589.001 | Credentials | — |
| T1589.002 | Email Addresses | — |
| T1590.005 | IP Addresses | — |
| T1591.001 | Determine Physical Locations | — |
| T1592.002 | Software | — |
| T1595.002 | Vulnerability Scanning | — |
| T1598.003 | Spearphishing Link | — |
| T1685 | Disable or Modify Tools | — |
| T1685.001 | Disable or Modify Windows Event Log | — |
| T1686.003 | Windows Host Firewall | — |
别名
APT35 · Charming Kitten · COBALT ILLUSION · ITG18 · Magic Hound · Mint Sandstorm · Newscaster · Phosphorus · TA453
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。