Início / Grupos de ameaça / Magic Hound

Magic Hound G0059

🔔 Criar alerta

Também conhecido como: TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

9

CVEs associadas

91

Técnicas

13

Malwares e ferramentas

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2021-44228 Crítica · 10.0 KEV Ransomware Apache Log4j2 Remote Code Execution Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

CVE-2021-34523 Crítica · 9.0 KEV Ransomware Microsoft Exchange Server Privilege Escalation Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

CVE-2021-34473 Crítica · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

CVE-2021-31207 Média · 6.6 KEV Ransomware Microsoft Exchange Server Security Feature Bypass Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

CVE-2021-27065 Alta · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.”

CVE-2021-26858 Alta · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.”

CVE-2021-26857 Alta · 7.8 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.”

CVE-2021-26855 Crítica · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability

“Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.”

CVE-2018-13379 Crítica · 9.8 KEV Ransomware Fortinet FortiOS SSL VPN Path Traversal Vulnerability

“Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).”

Técnicas por tática

Reconhecimento

T1589 Gather Victim Identity Information T1589.001 Credentials T1589.002 Email Addresses T1590.005 IP Addresses T1591.001 Determine Physical Locations T1592.002 Software T1595.002 Vulnerability Scanning T1598.003 Spearphishing Link

Desenvolvimento de recursos

T1583.001 Domains T1583.006 Web Services T1584.001 Domains T1585.001 Social Media Accounts T1585.002 Email Accounts T1586.002 Email Accounts T1588.002 Tool

Acesso inicial

T1078.001 Default Accounts T1078.002 Domain Accounts T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1566.002 Spearphishing Link T1566.003 Spearphishing via Service

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1204.001 Malicious Link T1204.002 Malicious File

Persistência

T1053.005 Scheduled Task T1078.001 Default Accounts T1078.002 Domain Accounts T1098.002 Additional Email Delegate Permissions T1098.007 Additional Local or Domain Groups T1112 Modify Registry T1136.001 Local Account T1505.003 Web Shell T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1078.001 Default Accounts T1078.002 Domain Accounts T1098.002 Additional Email Delegate Permissions T1098.007 Additional Local or Domain Groups T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027.010 Command Obfuscation T1027.013 Encrypted/Encoded File T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1036.010 Masquerade Account Name T1070.003 Clear Command History T1070.004 File Deletion T1078.001 Default Accounts T1078.002 Domain Accounts T1218.011 Rundll32 T1564.003 Hidden Window

Comprometimento de defesas

T1112 Modify Registry T1685 Disable or Modify Tools T1685.001 Disable or Modify Windows Event Log T1686.003 Windows Host Firewall

Acesso a credenciais

T1003.001 LSASS Memory T1056.001 Keylogging

Descoberta

T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1016.002 Wi-Fi Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.003 Email Account T1482 Domain Trust Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1570 Lateral Tool Transfer

Coleta

T1005 Data from Local System T1056.001 Keylogging T1113 Screen Capture T1114 Email Collection T1114.001 Local Email Collection T1114.002 Remote Email Collection T1560.001 Archive via Utility

Comando e controle

T1071 Application Layer Protocol T1071.001 Web Protocols T1090 Proxy T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1571 Non-Standard Port T1572 Protocol Tunneling T1573 Encrypted Channel

Exfiltração

T1567 Exfiltration Over Web Service

Impacto

T1486 Data Encrypted for Impact

Malwares e ferramentas

CharmPowerMalwareS0674
DownPaperMalwareS0186
PowerLessMalwareS1012
FRPFerramentaS1144
ImpacketFerramentaS0357
ipconfigFerramentaS0100
MimikatzFerramentaS0002
NetFerramentaS0039
netshFerramentaS0108
PingFerramentaS0097
PsExecFerramentaS0029
PupyFerramentaS0192
SysteminfoFerramentaS0096

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.