{
  "id": "magic-hound",
  "name": "Magic Hound",
  "aliases": [
    "TA453",
    "COBALT ILLUSION",
    "Charming Kitten",
    "ITG18",
    "Phosphorus",
    "Newscaster",
    "APT35",
    "Mint Sandstorm"
  ],
  "domain": "cyber",
  "country": "IRN",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "IRN"
  ],
  "summary": "Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Iranian-sponsored; likely Islamic Revolutionary Guard Corps (IRGC)",
      "src": [
        "mitre-g0059"
      ],
      "conf": "high"
    },
    {
      "k": "active_since",
      "v": 2014,
      "src": [
        "mitre-g0059"
      ],
      "conf": "medium",
      "note": "At least 2014"
    },
    {
      "k": "attack_id",
      "v": "G0059",
      "src": [
        "mitre-g0059"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.",
      "src": [
        "mitre-g0059"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 78,
      "src": [
        "mitre-g0059"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "CharmPower, DownPaper, FRP, Impacket, ipconfig, Mimikatz, Net, netsh, Ping, PowerLess, PsExec, Pupy, Systeminfo",
      "src": [
        "mitre-g0059"
      ],
      "conf": "high",
      "note": "13 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0059)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/magic-hound.html",
  "sources": {
    "mitre-g0059": {
      "title": "Magic Hound, Group G0059",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0059/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}