APT35

Introduction

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014. FireEye APT35 2018 ClearSky Kittens Back 3 August 2020 Certfa Charming Kitten January 2021 Secureworks COBALT ILLUSION Threat Profile Proofpoint TA453 July2021

Activities and Tactics

Targeted Sectors: Media, Academia, Government, Defense, Diplomacy, Military, Technology, Government, Administration

Country of Origin: 🇮🇷 Iran

Risk Level: High

First Seen: 2014

Last Activity: 2024

Incident Type: Espionage

Suspected Victims: U.S. government/defense sector websites, Saudi Arabia, Israel, Iraq, United Kingdom

Notable Campaigns

• 2020-05
• During a three-day period in May 2020
• IBM X-Force IRIS discovered the 40 GBs of video and data files being uploaded to a server that hosted numerous ITG18 domains used in earlier 2020 activity. Some of the videos showed the operator managing adversary-created accounts while others showed the operator testing access and exfiltrating data from previously compromised accounts.
• https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/

Tactics, Techniques, and Procedures (TTPs)

• T1056.001 Keylogging
• T1567 Exfiltration Over Web Service
• T1589.001 Credentials
• T1547.001 Registry Run Keys / Startup Folder
• T1059.001 PowerShell
• T1016.002 Wi-Fi Discovery
• T1588.002 Tool
• T1584.001 Domains
• T1059.003 Windows Command Shell
• T1572 Protocol Tunneling
• T1585.002 Email Accounts
• T1591.001 Determine Physical Locations
• T1071 Application Layer Protocol
• T1071.001 Web Protocols
• T1486 Data Encrypted for Impact
• T1016.001 Internet Connection Discovery
• T1586.002 Email Accounts
• T1053.005 Scheduled Task
• T1592.002 Software
• T1021.001 Remote Desktop Protocol
• T1087.003 Email Account
• T1105 Ingress Tool Transfer
• T1190 Exploit Public-Facing Application
• T1204.002 Malicious File
• T1218.011 Rundll32
• T1027.010 Command Obfuscation
• T1046 Network Service Discovery
• T1590.005 IP Addresses
• T1113 Screen Capture
• T1573 Encrypted Channel
• T1059.005 Visual Basic
• T1685.001 Disable or Modify Windows Event Log
• T1595.002 Vulnerability Scanning
• T1036.010 Masquerade Account Name
• T1589.002 Email Addresses
• T1204.001 Malicious Link
• T1102.002 Bidirectional Communication
• T1033 System Owner/User Discovery
• T1098.002 Additional Email Delegate Permissions
• T1070.004 File Deletion
• T1027.013 Encrypted/Encoded File
• T1566.002 Spearphishing Link
• T1078.001 Default Accounts
• T1083 File and Directory Discovery
• T1016 System Network Configuration Discovery
• T1036.005 Match Legitimate Resource Name or Location
• T1098.007 Additional Local or Domain Groups
• T1598.003 Spearphishing Link
• T1049 System Network Connections Discovery
• T1114 Email Collection
• T1003.001 LSASS Memory
• T1570 Lateral Tool Transfer
• T1136.001 Local Account
• T1057 Process Discovery
• T1114.002 Remote Email Collection
• T1571 Non-Standard Port
• T1686.003 Windows Host Firewall
• T1070.003 Clear Command History
• T1082 System Information Discovery
• T1114.001 Local Email Collection
• T1505.003 Web Shell
• T1090 Proxy
• T1036.004 Masquerade Task or Service
• T1583.001 Domains
• T1018 Remote System Discovery
• T1112 Modify Registry
• T1482 Domain Trust Discovery
• T1589 Gather Victim Identity Information
• T1078.002 Domain Accounts
• T1566.003 Spearphishing via Service
• T1560.001 Archive via Utility
• T1585.001 Social Media Accounts
• T1564.003 Hidden Window
• T1005 Data from Local System
• T1047 Windows Management Instrumentation
• T1583.006 Web Services
• T1685 Disable or Modify Tools
• T1189 Drive-by Compromise

ATT&CK technique IDs (denormalized)

• T1003.001
• T1005
• T1016
• T1016.001
• T1016.002
• T1018
• T1021.001
• T1027.010
• T1027.013
• T1033
• T1036.004
• T1036.005
• T1036.010
• T1046
• T1047
• T1049
• T1053.005
• T1056.001
• T1057
• T1059.001
• T1059.003
• T1059.005
• T1070.003
• T1070.004
• T1071
• T1071.001
• T1078.001
• T1078.002
• T1082
• T1083
• T1087.003
• T1090
• T1098.002
• T1098.007
• T1102.002
• T1105
• T1112
• T1113
• T1114
• T1114.001
• T1114.002
• T1136.001
• T1189
• T1190
• T1204.001
• T1204.002
• T1218.011
• T1482
• T1486
• T1505.003
• T1547.001
• T1560.001
• T1564.003
• T1566.002
• T1566.003
• T1567
• T1570
• T1571
• T1572
• T1573
• T1583.001
• T1583.006
• T1584.001
• T1585.001
• T1585.002
• T1586.002
• T1588.002
• T1589
• T1589.001
• T1589.002
• T1590.005
• T1591.001
• T1592.002
• T1595.002
• T1598.003
• T1685
• T1685.001
• T1686.003

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 2 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

• Back Orifice
• Back Orifice 2000

MITRE ATT&CK Software

• Net (S0039) — tool
• Impacket (S0357) — tool
• Ping (S0097) — tool
• CharmPower (S0674) — malware
• FRP (S1144) — tool
• Mimikatz (S0002) — tool
• Systeminfo (S0096) — tool
• ipconfig (S0100) — tool
• netsh (S0108) — tool
• PowerLess (S1012) — malware
• Pupy (S0192) — tool
• DownPaper (S0186) — malware
• PsExec (S0029) — tool

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [10] Microsoft Phosphorus Mar 2019 Burt, T. (2019, March 27). New steps to protect customers from hacking. Retrieved May 27, 2020. [11] Microsoft Phosphorus Oct 2020 Burt, T. (2020, October 28). Cyberattacks target international conference attendees. Retrieved March 8, 2021. [12] Certfa Charming Kitten January 2021 Certfa Labs. (2021, January 8). Charming Kitten’s Christmas Gift. Retrieved May 3, 2021. [13] Check Point APT35 CharmPower January 2022 Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022. [14] ClearSky Charming Kitten Dec 2017 ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017. [15] ClearSky Kittens Back 2 Oct 2019 ClearSky Research Team. (2019, October 1). The Kittens Are Back in Town2 - Charming Kitten Campaign KeepsGoing on, Using New Impersonation Methods. Retrieved April 21, 2021. [16] ClearSky Kittens Back 3 August 2020 ClearSky Research Team. (2020, August 1). The Kittens Are Back in Town 3 - Charming Kitten Campaign Evolved and Deploying Spear-Phishing link by WhatsApp. Retrieved April 21, 2021. [17] Eweek Newscaster and Charming Kitten May 2014 Kerner, S. (2014, May 29). Newscaster Threat Uses Social Media for Intelligence Gathering. Retrieved April 14, 2021. [18] Unit 42 Magic Hound Feb 2017 Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017. [20] FireEye APT35 2018 Mandiant. (2018). Mandiant M-Trends 2018. Retrieved November 17, 2024. [21] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [22] Proofpoint TA453 July2021 Miller, J. et al. (2021, July 13). Operation SpoofedScholars: A Conversation with TA453. Retrieved August 18, 2021. [23] Proofpoint TA453 March 2021 Miller, J. et al. (2021, March 30). BadBlood: TA453 Targets US and Israeli Medical Research Personnel in Credential Phishing Campaigns. Retrieved May 4, 2021. [24] Secureworks COBALT ILLUSION Threat Profile Secureworks. (n.d.). COBALT ILLUSION Threat Profile. Retrieved April 14, 2021. [25] US District Court of DC Phosphorus Complaint 2019 US District Court of DC. (2019, March 14). MICROSOFT CORPORATION v. JOHN DOES 1-2, CONTROLLING A COMPUTER NETWORK AND THEREBY INJURING PLAINTIFF AND ITS CUSTOMERS. Retrieved March 8, 2021. [26] IBM ITG18 2020 Wikoff, A. Emerson, R. (2020, July 16). New Research Exposes Iranian Threat Group Operations. Retrieved March 8, 2021.