Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Magic Hound

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)

ID: G0059

Associated Groups: Charming Kitten, APT35, ITG18, Phosphorus, Mint Sandstorm, TA453, COBALT ILLUSION, Newscaster

Version: 6.1

Created: 16 Jan 2018

Last Modified: 10 Jul 2024

Name	Description
Associated Group Descriptions
Charming Kitten	(Citation: ClearSky Charming Kitten Dec 2017)(Citation: Eweek Newscaster and Charming Kitten May 2014)(Citation: ClearSky Kittens Back 2 Oct 2019)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Proofpoint TA453 March 2021)(Citation: Check Point APT35 CharmPower January 2022)
APT35	(Citation: FireEye APT35 2018)(Citation: Certfa Charming Kitten January 2021)(Citation: Check Point APT35 CharmPower January 2022)
ITG18	(Citation: IBM ITG18 2020)
Phosphorus	(Citation: Microsoft Phosphorus Mar 2019)(Citation: Microsoft Phosphorus Oct 2020)(Citation: US District Court of DC Phosphorus Complaint 2019)(Citation: Certfa Charming Kitten January 2021)(Citation: Proofpoint TA453 March 2021)(Citation: Check Point APT35 CharmPower January 2022)
Mint Sandstorm	(Citation: Microsoft Threat Actor Naming July 2023)
TA453	(Citation: Proofpoint TA453 March 2021)(Citation: Proofpoint TA453 July2021)(Citation: Check Point APT35 CharmPower January 2022)
COBALT ILLUSION	(Citation: Secureworks COBALT ILLUSION Threat Profile)
Newscaster	Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the older attack campaign called Newscaster (aka Newscasters).(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)

Domain	ID		Name	Use
Techniques Used
Enterprise	T1087	.003	Account Discovery: Email Account	Magic Hound has used Powershell to discover email accounts.(Citation: DFIR Report APT35 ProxyShell March 2022)
Enterprise	T1098	.002	Account Manipulation: Additional Email Delegate Permissions	Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.(Citation: FireEye APT35 2018)
		.007	Account Manipulation: Additional Local or Domain Groups	Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.(Citation: DFIR Report APT35 ProxyShell March 2022)
Enterprise	T1583	.001	Acquire Infrastructure: Domains	Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.(Citation: Certfa Charming Kitten January 2021)
		.006	Acquire Infrastructure: Web Services	Magic Hound has acquired Amazon S3 buckets to use in C2.(Citation: Check Point APT35 CharmPower January 2022)
Enterprise	T1595	.002	Active Scanning: Vulnerability Scanning	Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.(Citation: Check Point APT35 CharmPower January 2022)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Enterprise	T1071	.001	Application Layer Protocol: Web Protocols	Magic Hound has used HTTP for C2.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
Enterprise	T1560	.001	Archive Collected Data: Archive via Utility	Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.(Citation: FireEye APT35 2018)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
Enterprise	T1547	.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Magic Hound malware has used Registry Run keys to establish persistence.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Enterprise	T1059	.001	Command and Scripting Interpreter: PowerShell	Magic Hound has used PowerShell for execution and privilege escalation.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
		.003	Command and Scripting Interpreter: Windows Command Shell	Magic Hound has used the command-line interface for code execution.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
		.005	Command and Scripting Interpreter: Visual Basic	Magic Hound malware has used VBS scripts for execution.(Citation: Unit 42 Magic Hound Feb 2017)
Enterprise	T1586	.002	Compromise Accounts: Email Accounts	Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.(Citation: IBM ITG18 2020)
Enterprise	T1584	.001	Compromise Infrastructure: Domains	Magic Hound has used compromised domains to host links targeted to specific phishing victims.(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Proofpoint TA453 July2021)(Citation: Certfa Charming Kitten January 2021)(Citation: Google Iran Threats October 2021)
Enterprise	T1136	.001	Create Account: Local Account	Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Enterprise	T1555	.003	Credentials from Password Stores: Credentials from Web Browsers	Magic Hound used FireMalv, custom-developed malware, which collected passwords from the Firefox browser storage.(Citation: Check Point Rocket Kitten)
Enterprise	T1114	.001	Email Collection: Local Email Collection	Magic Hound has collected .PST archives.(Citation: FireEye APT35 2018)
		.002	Email Collection: Remote Email Collection	Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
Enterprise	T1585	.001	Establish Accounts: Social Media Accounts	Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.(Citation: ClearSky Kittens Back 3 August 2020)
		.002	Establish Accounts: Email Accounts	Magic Hound has established email accounts using fake personas for spearphishing operations.(Citation: IBM ITG18 2020)(Citation: Proofpoint TA453 March 2021)
Enterprise	T1592	.002	Gather Victim Host Information: Software	Magic Hound has captured the user-agent strings from visitors to their phishing sites.(Citation: Google Iran Threats October 2021)
Enterprise	T1589	.001	Gather Victim Identity Information: Credentials	Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.(Citation: IBM ITG18 2020)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
		.002	Gather Victim Identity Information: Email Addresses	Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.(Citation: Proofpoint TA453 July2021)(Citation: Google Iran Threats October 2021)
Enterprise	T1590	.005	Gather Victim Network Information: IP Addresses	Magic Hound has captured the IP addresses of visitors to their phishing sites.(Citation: Google Iran Threats October 2021)
Enterprise	T1591	.001	Gather Victim Org Information: Determine Physical Locations	Magic Hound has collected location information from visitors to their phishing sites.(Citation: Google Iran Threats October 2021)
Enterprise	T1564	.003	Hide Artifacts: Hidden Window	Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.(Citation: Unit 42 Magic Hound Feb 2017)
Enterprise	T1562	.001	Impair Defenses: Disable or Modify Tools	Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.(Citation: DFIR Report APT35 ProxyShell March 2022)
		.002	Impair Defenses: Disable Windows Event Logging	Magic Hound has executed scripts to disable the event log service.(Citation: DFIR Phosphorus November 2021)
		.004	Impair Defenses: Disable or Modify System Firewall	Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
Enterprise	T1070	.003	Indicator Removal: Clear Command History	Magic Hound has removed mailbox export requests from compromised Exchange servers.(Citation: DFIR Report APT35 ProxyShell March 2022)
		.004	Indicator Removal: File Deletion	Magic Hound has deleted and overwrote files to cover tracks.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)(Citation: DFIR Phosphorus November 2021)
Enterprise	T1056	.001	Input Capture: Keylogging	Magic Hound malware is capable of keylogging.(Citation: Unit 42 Magic Hound Feb 2017)
Enterprise	T1036	.004	Masquerading: Masquerade Task or Service	Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.(Citation: DFIR Phosphorus November 2021)
		.005	Masquerading: Match Legitimate Name or Location	Magic Hound has used `dllhost.exe` to mask Fast Reverse Proxy (FRP) and `MicrosoftOutLookUpdater.exe` for Plink.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
		.010	Masquerading: Masquerade Account Name	Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Enterprise	T1003	.001	OS Credential Dumping: LSASS Memory	Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.(Citation: FireEye APT35 2018)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Enterprise	T1027	.010	Obfuscated Files or Information: Command Obfuscation	Magic Hound has used base64-encoded commands.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
		.013	Obfuscated Files or Information: Encrypted/Encoded File	Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Enterprise	T1588	.002	Obtain Capabilities: Tool	Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.(Citation: Check Point Rocket Kitten)(Citation: FireEye APT35 2018)(Citation: Check Point APT35 CharmPower January 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Enterprise	T1566	.001	Phishing: Spearphishing Attachment	Magic Hound has used personalized spearphishing attachments.(Citation: Check Point Rocket Kitten)
		.002	Phishing: Spearphishing Link	Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.(Citation: Secureworks Cobalt Gypsy Feb 2017)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
		.003	Phishing: Spearphishing via Service	Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.(Citation: SecureWorks Mia Ash July 2017)(Citation: Microsoft Phosphorus Mar 2019)(Citation: ClearSky Kittens Back 3 August 2020)
Enterprise	T1598	.003	Phishing for Information: Spearphishing Link	Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.(Citation: Certfa Charming Kitten January 2021)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Proofpoint TA453 March 2021)(Citation: Proofpoint TA453 July2021)(Citation: Google Iran Threats October 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Enterprise	T1021	.001	Remote Services: Remote Desktop Protocol	Magic Hound has used Remote Desktop Services to copy tools on targeted systems.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
Enterprise	T1053	.005	Scheduled Task/Job: Scheduled Task	Magic Hound has used scheduled tasks to establish persistence and execution.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
Enterprise	T1505	.003	Server Software Component: Web Shell	Magic Hound has used multiple web shells to gain execution.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
Enterprise	T1218	.011	System Binary Proxy Execution: Rundll32	Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.(Citation: DFIR Report APT35 ProxyShell March 2022)
Enterprise	T1016	.001	System Network Configuration Discovery: Internet Connection Discovery	Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.(Citation: DFIR Phosphorus November 2021)
		.002	System Network Configuration Discovery: Wi-Fi Discovery	Magic Hound has collected names and passwords of all Wi-Fi networks to which a device has previously connected.(Citation: Check Point APT35 CharmPower January 2022)
Enterprise	T1204	.001	User Execution: Malicious Link	Magic Hound has attempted to lure victims into opening malicious links embedded in emails.(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)
		.002	User Execution: Malicious File	Magic Hound has lured victims into executing malicious files.(Citation: FireEye Operation Saffron Rose 2013)
		.002	User Execution: Malicious File	Magic Hound has attempted to lure victims into opening malicious email attachments.(Citation: ClearSky Kittens Back 3 August 2020)
Enterprise	T1078	.001	Valid Accounts: Default Accounts	Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.(Citation: DFIR Phosphorus November 2021)
		.002	Valid Accounts: Domain Accounts	Magic Hound has used domain administrator accounts after dumping LSASS process memory.(Citation: DFIR Phosphorus November 2021)
Enterprise	T1102	.002	Web Service: Bidirectional Communication	Magic Hound malware can use a SOAP Web service to communicate with its C2 server.(Citation: Unit 42 Magic Hound Feb 2017)

ID	Name	References	Techniques
Software
S0039	Net	(Citation: DFIR Phosphorus November 2021) (Citation: DFIR Report APT35 ProxyShell March 2022) (Citation: Microsoft Net Utility) (Citation: Savill 1999)	Password Policy Discovery, Domain Groups, System Time Discovery, Domain Account, Local Account, System Service Discovery, Remote System Discovery, Network Share Discovery, System Network Connections Discovery, Network Share Connection Removal, Service Execution, Local Account, Additional Local or Domain Groups, Local Groups, SMB/Windows Admin Shares, Domain Account
S0357	Impacket	(Citation: DFIR Phosphorus November 2021) (Citation: Impacket Tools)	LLMNR/NBT-NS Poisoning and SMB Relay, Network Sniffing, Kerberoasting, Ccache Files, NTDS, Service Execution, LSASS Memory, Windows Management Instrumentation, Security Account Manager, LSA Secrets
S0100	ipconfig	(Citation: DFIR Phosphorus November 2021) (Citation: DFIR Report APT35 ProxyShell March 2022) (Citation: TechNet Ipconfig)	System Network Configuration Discovery
S1012	PowerLess	(Citation: Cybereason PowerLess February 2022)	Keylogging, Browser Information Discovery, Ingress Tool Transfer, Data from Local System, Encrypted Channel, Local Data Staging, Archive Collected Data, PowerShell, Deobfuscate/Decode Files or Information
S1144	FRP	(Citation: DFIR Phosphorus November 2021) (Citation: FRP GitHub) (Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023) (Citation: RedCanary Mockingbird May 2020)	Non-Application Layer Protocol, JavaScript, Proxy, Protocol Tunneling, Asymmetric Cryptography, Network Service Discovery, System Network Connections Discovery, Multi-hop Proxy, Symmetric Cryptography, Web Protocols
S0108	netsh	(Citation: DFIR Report APT35 ProxyShell March 2022) (Citation: TechNet Netsh)	Disable or Modify System Firewall, Netsh Helper DLL, Proxy, Security Software Discovery
S0674	CharmPower	(Citation: Check Point APT35 CharmPower January 2022)	Modify Registry, System Information Discovery, Software Discovery, Exfiltration Over Unencrypted Non-C2 Protocol, Symmetric Cryptography, Deobfuscate/Decode Files or Information, Exfiltration Over C2 Channel, Dead Drop Resolver, File and Directory Discovery, PowerShell, File Deletion, Web Protocols, Fallback Channels, System Network Connections Discovery, Process Discovery, Web Service, Data from Local System, Windows Command Shell, System Network Configuration Discovery, Screen Capture, Ingress Tool Transfer, Standard Encoding, Windows Management Instrumentation, Query Registry
S0096	Systeminfo	(Citation: DFIR Phosphorus November 2021) (Citation: TechNet Systeminfo)	System Information Discovery
S0225	sqlmap	(Citation: Check Point Rocket Kitten) (Citation: sqlmap Introduction)	Exploit Public-Facing Application
S0002	Mimikatz	(Citation: Adsecurity Mimikatz Guide) (Citation: Deply Mimikatz) (Citation: FireEye APT35 2018)	DCSync, Credentials from Password Stores, Rogue Domain Controller, Private Keys, SID-History Injection, Security Support Provider, Pass the Hash, Account Manipulation, Pass the Ticket, Credentials from Web Browsers, Golden Ticket, Security Account Manager, LSASS Memory, Silver Ticket, Windows Credential Manager, Steal or Forge Authentication Certificates, LSA Secrets
S0097	Ping	(Citation: DFIR Phosphorus November 2021) (Citation: TechNet Ping)	Remote System Discovery
S0192	Pupy	(Citation: FireEye APT35 2018) (Citation: GitHub Pupy) (Citation: Secureworks Cobalt Gypsy Feb 2017) (Citation: Unit 42 Magic Hound Feb 2017)	Service Execution, Network Service Discovery, Screen Capture, Credentials In Files, Ingress Tool Transfer, Network Share Discovery, Asymmetric Cryptography, Bypass User Account Control, PowerShell, System Owner/User Discovery, Domain Account, Exfiltration Over C2 Channel, Credentials from Web Browsers, Audio Capture, Dynamic-link Library Injection, System Network Configuration Discovery, Local Email Collection, Systemd Service, Local Account, XDG Autostart Entries, File and Directory Discovery, System Information Discovery, LSASS Memory, Keylogging, Web Protocols, System Checks, Remote Desktop Protocol, Pass the Ticket, LLMNR/NBT-NS Poisoning and SMB Relay, Local Account, Python, Video Capture, Clear Windows Event Logs, Token Impersonation/Theft, Archive via Utility, Registry Run Keys / Startup Folder, Cached Domain Credentials, LSA Secrets, System Network Connections Discovery, Credentials from Password Stores, Process Discovery
S0186	DownPaper	(Citation: ClearSky Charming Kitten Dec 2017)	System Information Discovery, Query Registry, System Owner/User Discovery, Registry Run Keys / Startup Folder, Web Protocols, PowerShell, Windows Command Shell
S0224	Havij	(Citation: Check Point Havij Analysis) (Citation: Check Point Rocket Kitten)	Exploit Public-Facing Application
S0029	PsExec	(Citation: FireEye APT35 2018) (Citation: Russinovich Sysinternals) (Citation: SANS PsExec)	SMB/Windows Admin Shares, Windows Service, Lateral Tool Transfer, Service Execution, Domain Account

References

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Magic Hound

Associated Group Descriptions

Techniques Used

Software

References