Home / Threat actors / Magic Hound

Magic Hound G0059

🔔 Create alert

Also known as: TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

9

associated CVEs

91

Techniques

13

Malware and tools

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-44228 Critical · 10.0 KEV Ransomware Apache Log4j2 Remote Code Execution Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

CVE-2021-34523 Critical · 9.0 KEV Ransomware Microsoft Exchange Server Privilege Escalation Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

CVE-2021-34473 Critical · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

CVE-2021-31207 Medium · 6.6 KEV Ransomware Microsoft Exchange Server Security Feature Bypass Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

CVE-2021-27065 High · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.”

CVE-2021-26858 High · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.”

CVE-2021-26857 High · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.”

CVE-2021-26855 Critical · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.”

CVE-2018-13379 Critical · 9.8 KEV Ransomware Fortinet FortiOS SSL VPN Path Traversal Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

Techniques by tactic

Reconnaissance

T1589 Gather Victim Identity Information T1589.001 Credentials T1589.002 Email Addresses T1590.005 IP Addresses T1591.001 Determine Physical Locations T1592.002 Software T1595.002 Vulnerability Scanning T1598.003 Spearphishing Link

Resource Development

T1583.001 Domains T1583.006 Web Services T1584.001 Domains T1585.001 Social Media Accounts T1585.002 Email Accounts T1586.002 Email Accounts T1588.002 Tool

Initial Access

T1078.001 Default Accounts T1078.002 Domain Accounts T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1566.002 Spearphishing Link T1566.003 Spearphishing via Service

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1204.001 Malicious Link T1204.002 Malicious File

Persistence

T1053.005 Scheduled Task T1078.001 Default Accounts T1078.002 Domain Accounts T1098.002 Additional Email Delegate Permissions T1098.007 Additional Local or Domain Groups T1112 Modify Registry T1136.001 Local Account T1505.003 Web Shell T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task T1078.001 Default Accounts T1078.002 Domain Accounts T1098.002 Additional Email Delegate Permissions T1098.007 Additional Local or Domain Groups T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.010 Command Obfuscation T1027.013 Encrypted/Encoded File T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1036.010 Masquerade Account Name T1070.003 Clear Command History T1070.004 File Deletion T1078.001 Default Accounts T1078.002 Domain Accounts T1218.011 Rundll32 T1564.003 Hidden Window

Defense Impairment

T1112 Modify Registry T1685 Disable or Modify Tools T1685.001 Disable or Modify Windows Event Log T1686.003 Windows Host Firewall

Credential Access

T1003.001 LSASS Memory T1056.001 Keylogging

Discovery

T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1016.002 Wi-Fi Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.003 Email Account T1482 Domain Trust Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1570 Lateral Tool Transfer

Collection

T1005 Data from Local System T1056.001 Keylogging T1113 Screen Capture T1114 Email Collection T1114.001 Local Email Collection T1114.002 Remote Email Collection T1560.001 Archive via Utility

Command and Control

T1071 Application Layer Protocol T1071.001 Web Protocols T1090 Proxy T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1571 Non-Standard Port T1572 Protocol Tunneling T1573 Encrypted Channel

Exfiltration

T1567 Exfiltration Over Web Service

Impact

T1486 Data Encrypted for Impact

Malware and tools

CharmPowerMalwareS0674
DownPaperMalwareS0186
PowerLessMalwareS1012
FRPToolS1144
ImpacketToolS0357
ipconfigToolS0100
MimikatzToolS0002
NetToolS0039
netshToolS0108
PingToolS0097
PsExecToolS0029
PupyToolS0192
SysteminfoToolS0096

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.