Magic Hound

Overview

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.

Naming & attribution

Magic Hound is tracked under 9 names across the industry. It uses 78 documented ATT&CK techniques — more than 95% of the 174 groups tracked here. Activity attributed since at least 2014.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1016.002 Wi-Fi Discovery — used by 1 of 174 groups
• T1591.001 Determine Physical Locations — used by 1 of 174 groups
• T1685.001 Disable or Modify Windows Event Log — used by 2 of 174 groups
• T1098.002 Additional Email Delegate Permissions — used by 3 of 174 groups
• T1590.005 IP Addresses — used by 3 of 174 groups
• T1592.002 Software — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• APT32 Vietnam — 39 shared techniques (33% overlap)
• Sandworm Team Russia — 38 shared techniques (32% overlap)
• Lazarus Group North Korea — 38 shared techniques (29% overlap)
• Kimsuky North Korea — 45 shared techniques (28% overlap)
• FIN13 — 29 shared techniques (28% overlap)
• APT41 China — 34 shared techniques (27% overlap)

Targets

Defense · Diplomacy · Government · Military · Technology

Regions

Iraq · Israel · Saudi Arabia · U.S. government/defense sector websites · United Kingdom

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190
• Custom malware/implant development — ATT&CK: 3 attributed custom malware families

TTPs — 78 techniques across 14 tactics

Tools & malware (13)

Net · Impacket · Ping · CharmPower · FRP · Mimikatz · Systeminfo · ipconfig · netsh · PowerLess · Pupy · DownPaper · PsExec

Reporting (3)

• How Microsoft names threat actors — Microsoft
• APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit — Check Point
• Operation SpoofedScholars: A Conversation with TA453 — Miller, J. et al