D
CyberIran

Magic Hound

State-sponsored cyber threat groupTrackedPending verification

Also known as: TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm

CyberIRN
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeState-sponsored cyber threat group
Alternative designationsTA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm
ProliferationOrigin country only
Active since2014At least 2014Med[1]
MITRE ATT&CK IDG0059High[1]
Capabilities
ATT&CK techniques used78ATT&CK v20.1High[1]
Malware and toolsCharmPower, DownPaper, FRP, Impacket, ipconfig, Mimikatz, Net, netsh, Ping, PowerLess, PsExec, Pupy, Systeminfo13 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorIranian-sponsored; likely Islamic Revolutionary Guard Corps (IRGC)High[1]
TargetsThey have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.Med[1]
Notes
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Iran
Sources
  1. Magic Hound, Group G0059, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0059)