Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive operations to collect intelligence, dating back as early as 2014. The group typically targets U.S. and the Middle Eastern military, as well as other organizations with government personnel, via complex social engineering campaigns.[1]
Associated Group Descriptions
Name | Description |
---|---|
Cobalt Gypsy |
Based on overlapping hash values in reporting, Magic Hound activity appears to overlap with activity conducted by the group known as Cobalt Gypsy.[2] |
Operation Woolen-Goldfish |
Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the campaign Operation Woolen-Goldfish.[3] |
Ajax Security Team |
Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the group Ajax Security Team.[3] |
Operation Saffron Rose |
Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the campaign Operation Saffron Rose.[3] |
Rocket Kitten |
Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the adversary group Rocket Kitten.[3][4] |
Phosphorus | |
Newscaster |
Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the older attack campaign called Newscaster (aka Newscasters).[3][1] |
APT35 |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1098 | .002 | Account Manipulation: Exchange Email Delegate Permissions |
Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.[1] |
Enterprise | T1071 | Application Layer Protocol |
Magic Hound malware has used IRC for C2.[3] |
|
.001 | Web Protocols |
Magic Hound malware has used HTTP for C2.[3] |
||
Enterprise | T1560 | .001 | Archive Collected Data: Archive via Utility |
Magic Hound has used RAR to stage and compress local folders.[1] |
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Magic Hound malware has used Registry Run keys to establish persistence.[3] |
Enterprise | T1059 | .005 | Command and Scripting Interpreter: Visual Basic |
Magic Hound malware has used VBS scripts for execution.[3] |
.003 | Command and Scripting Interpreter: Windows Command Shell |
Magic Hound has used the command-line interface.[3] |
||
.001 | Command and Scripting Interpreter: PowerShell |
Magic Hound has used PowerShell for execution and privilege escalation.[3][1] |
||
Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
Magic Hound used FireMalv, custom-developed malware, which collected passwords from the Firefox browser storage.[6] |
Enterprise | T1114 | .001 | Email Collection: Local Email Collection |
Magic Hound has collected .PST archives.[1] |
Enterprise | T1083 | File and Directory Discovery |
Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.[3] |
|
Enterprise | T1564 | .003 | Hide Artifacts: Hidden Window |
Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.[3] |
Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion |
Magic Hound has deleted and overwrote files to cover tracks.[3][1] |
Enterprise | T1105 | Ingress Tool Transfer |
Magic Hound has downloaded additional code and files from servers onto victims.[3] Magic Hound used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.[6][6] |
|
Enterprise | T1056 | .001 | Input Capture: Keylogging |
Magic Hound malware is capable of keylogging.[3] Magic Hound used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.[6] |
Enterprise | T1571 | Non-Standard Port |
Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.[3] |
|
Enterprise | T1027 | Obfuscated Files or Information |
Magic Hound malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.[3] |
|
Enterprise | T1003 | .001 | OS Credential Dumping: LSASS Memory |
Magic Hound stole domain credentials from Microsoft Active Directory Domain Controller and leveraged Mimikatz.[1] |
Enterprise | T1566 | .002 | Phishing: Spearphishing Link |
Magic Hound sent shortened URL links over email to victims. The URLs linked to Word documents with malicious macros that execute PowerShells scripts to download Pupy. |
.001 | Phishing: Spearphishing Attachment |
Magic Hound has used personalized spearphishing attachments.[6] |
||
.003 | Phishing: Spearphishing via Service |
Magic Hound used various social media channels to spearphish victims.[7][8][5] |
||
Enterprise | T1057 | Process Discovery |
Magic Hound malware can list running processes.[3] |
|
Enterprise | T1113 | Screen Capture |
Magic Hound malware can take a screenshot and upload the file to its C2 server.[3] |
|
Enterprise | T1082 | System Information Discovery |
Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.[3] |
|
Enterprise | T1016 | System Network Configuration Discovery |
Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.[3] |
|
Enterprise | T1033 | System Owner/User Discovery |
Magic Hound malware has obtained the victim username and sent it to the C2 server.[3] |
|
Enterprise | T1204 | .002 | User Execution: Malicious File |
Magic Hound has lured victims into executing malicious files.[7] |
Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |
Magic Hound malware can use a SOAP Web service to communicate with its C2 server.[3] |
Software
References
- Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018.
- Counter Threat Unit Research Team. (2017, February 15). Iranian PupyRAT Bites Middle Eastern Organizations. Retrieved December 27, 2017.
- Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
- ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017.
- Burt, T.. (2019, March 27). New steps to protect customers from hacking. Retrieved May 27, 2020.
- Check Point Software Technologies. (2015). ROCKET KITTEN: A CAMPAIGN WITH 9 LIVES. Retrieved March 16, 2018.
- Villeneuve, N. et al.. (2013). OPERATION SAFFRON ROSE . Retrieved May 28, 2020.
- Counter Threat Unit Research Team. (2017, July 27). The Curious Case of Mia Ash: Fake Persona Lures Middle Eastern Targets. Retrieved February 26, 2018.