Magic Hound
IntrusionSet · ATTACK:enterprise:G0059
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0059",
"title": "Magic Hound",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0059",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--f9d6633a-55e6-4adc-9263-6ae080421a13",
"external_id": "G0059",
"domain": "enterprise",
"created": "2018-01-16T16:13:52.465Z",
"modified": "2026-07-31T18:48:27.286Z",
"version": "6.1",
"aliases": [
"Magic Hound",
"TA453",
"COBALT ILLUSION",
"Charming Kitten",
"ITG18",
"Phosphorus",
"Newscaster",
"APT35",
"Mint Sandstorm"
],
"tactics": [
],
"source_references": [
{
"source_name": "Charming Kitten"
},
{
"source_name": "APT35"
},
{
"source_name": "ITG18"
},
{
"source_name": "Phosphorus"
},
{
"source_name": "Mint Sandstorm"
},
{
"source_name": "TA453"
},
{
"source_name": "COBALT ILLUSION"
},
{
"source_name": "Magic Hound"
},
{
"source_name": "Microsoft Phosphorus Mar 2019",
"url": "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/"
},
{
"source_name": "Microsoft Phosphorus Oct 2020",
"url": "https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/"
},
{
"source_name": "Certfa Charming Kitten January 2021",
"url": "https://blog.certfa.com/posts/charming-kitten-christmas-gift/"
},
{
"source_name": "Check Point APT35 CharmPower January 2022",
"url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
},
{
"source_name": "ClearSky Charming Kitten Dec 2017",
"url": "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"
},
{
"source_name": "ClearSky Kittens Back 2 Oct 2019",
"url": "https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2-1.pdf"
},
{
"source_name": "ClearSky Kittens Back 3 August 2020",
"url": "https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"
},
{
"source_name": "Eweek Newscaster and Charming Kitten May 2014",
"url": "https://www.eweek.com/security/newscaster-threat-uses-social-media-for-intelligence-gathering"
},
{
"source_name": "Unit 42 Magic Hound Feb 2017",
"url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"
},
{
"source_name": "Newscaster"
},
{
"source_name": "FireEye APT35 2018",
"url": "https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint TA453 July2021",
"url": "https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453"
},
{
"source_name": "Proofpoint TA453 March 2021",
"url": "https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential"
},
{
"source_name": "Secureworks COBALT ILLUSION Threat Profile",
"url": "https://www.secureworks.com/research/threat-profiles/cobalt-illusion"
},
{
"source_name": "US District Court of DC Phosphorus Complaint 2019",
"url": "https://noticeofpleadings.com/phosphorus/files/Complaint.pdf"
},
{
"source_name": "IBM ITG18 2020",
"url": "https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/"
}
]
}Explicit source assertions (91)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--023ff141-8ed7-4132-85a0-494fe075236b
Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1567
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--043ea873-396a-4ba8-a3e3-1f9af11c986e
Google Iran Threats October 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--078fb58f-0b5b-4021-8467-800893c35d08
Microsoft Iranian Threat Actor Trends November 2021 · IBM ITG18 2020ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a507d28-ef6b-417b-a968-e82608e8b6a8
DFIR Phosphorus November 2021 · Unit 42 Magic Hound Feb 2017 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--110690db-fd9b-425a-9269-ec082f0af3f9
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017 · FireEye APT35 2018 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1016.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11087b2c-2d00-4a57-a974-045010c7bab5
Check Point APT35 CharmPower January 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1134f983-3ad3-4c79-baaa-f604ac9dc642
Check Point Rocket Kitten · Check Point APT35 CharmPower January 2022 · DFIR Phosphorus November 2021 · FireEye APT35 2018 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--134cc6c4-30f8-4b85-8ea1-da19c3e92af9
Google Iran Threats October 2021 · Certfa Charming Kitten January 2021 · ClearSky Kittens Back 3 August 2020 · Proofpoint TA453 July2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17bc0957-1509-4faf-bb51-a6a9e1959978
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19bef554-d625-49f9-a521-c6a8ed773083
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a163c8a-7a12-4cd4-813f-38f5a05ba98d
Proofpoint TA453 March 2021 · IBM ITG18 2020ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b255a88-0189-4afa-a69f-fa99127e693e
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--205c5e6d-90c1-4369-98ee-9968f87d687c
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1591.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20a3c703-46d5-4038-9b3f-9afe15d84023
Google Iran Threats October 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27c6ffb3-836c-4a43-9862-b77c8e4a8256
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1071
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b5af448-59a1-4888-a05f-aee6105872a5
DFIR Phosphorus November 2021 · Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dd15583-34cd-4b49-a6ba-4bd647b7ff27
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30da3c92-05b8-40fd-b8b6-29cb20a597a1
DFIR Phosphorus November 2021 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31f93f78-799b-4f65-892c-da3aba4bb32d
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32126e79-18ce-4393-a555-50aa34760da9
IBM ITG18 2020ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33390e6e-f262-48fb-a74a-084c310b3aa2
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1592.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3499e2c5-e22a-4e99-ae90-3c7b48aa5ccb
Google Iran Threats October 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43c20c81-984f-418a-9202-252a3afbec46
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1087.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45ce4803-9ed5-4960-ac34-7fe3b22919d5
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47f521b8-37e4-489d-b6eb-25f35de80aae
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0674
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--501cd276-7cb4-40a6-b8be-d6cc6d743edc
Check Point APT35 CharmPower January 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54af36a6-0a08-4853-9002-a1ae51b22ca5
Check Point APT35 CharmPower January 2022 · Cybereason PowerLess February 2022 · DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Microsoft Log4j Vulnerability Exploitation December 2021 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56d37b60-03e0-4aac-b106-0350c2a4ec46
ClearSky Kittens Back 3 August 2020ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57597bcb-9cbc-49d4-adfb-fb4c0fe6090e
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5829ee6d-68e4-44a8-828e-ba188b14c163
Unit 42 Magic Hound Feb 2017 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d55b1c4-cdf4-4314-881e-ba0c853b1b60
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1590.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62fe41c2-3ee6-45eb-a38e-a6c27d151933
Google Iran Threats October 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S1144
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6372dcb7-0f8e-45cd-a1a6-5a2cfc4c22ee
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65f7704a-358a-464d-b09b-fee5dd96adf3
Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--665e5a7f-e575-44c7-839d-4c69f14238d2
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--675f24e0-c445-4eb3-a191-16fb181f6e30
Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67f2ca97-5949-4503-a55c-1f0d3f3502ca
FireEye APT35 2018ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69bb1028-e746-4b3a-9b96-9e9c66109c61
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6dca82b3-7a95-4fcd-862e-6337eea49306
Check Point APT35 CharmPower January 2022 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1036.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f757d38-9e79-4a04-9ed8-972ed69e3a63
DFIR Report APT35 ProxyShell March 2022 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0096
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--703694f1-755e-4e3f-aff2-f623ec842693
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76ecca4d-15ba-4285-baa9-1cf03799dbeb
Google Iran Threats October 2021 · Proofpoint TA453 July2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77a98e76-5a38-40a8-af9a-180c31bf7563
Certfa Charming Kitten January 2021 · ClearSky Kittens Back 3 August 2020ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79f89b33-046c-4bfa-a12d-c50fa0d84ea6
Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ac10827-9bf6-4d60-aa16-9f2d2930b373
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1098.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e636340-8b64-4913-be75-a8e62f68fc91
FireEye APT35 2018ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f17927d-b371-42c4-bd68-0c5c57e3edab
DFIR Phosphorus November 2021 · Unit 42 Magic Hound Feb 2017 · FireEye APT35 2018ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0100
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f32b01c-ecf6-457e-8bca-6c74c02b439e
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8087d99b-cc05-4e2a-abce-687eb726a9e7
Unit 42 Magic Hound Feb 2017 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--808f140e-8b7b-4efa-8708-2f2308b2fc41
Certfa Charming Kitten January 2021 · ClearSky Kittens Back 3 August 2020 · Secureworks Cobalt Gypsy Feb 2017 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--815e257d-f4bf-4124-8063-634d6710d66f
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87b8b451-bf9b-4e93-b591-05ef502970f5
Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88c50625-6d02-42fb-aa82-4315a532b754
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ab4fa22-a24c-4596-996e-4abf190521da
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1098.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c4a2bd5-109b-4e49-ae67-a9bf02a029e7
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e03a9bc-a701-4797-8f0e-0eb17f32ddac
Google Iran Threats October 2021 · Certfa Charming Kitten January 2021 · ClearSky Kittens Back 3 August 2020 · Proofpoint TA453 July2021 · Proofpoint TA453 March 2021 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95df0f16-1c35-4603-baae-4559113f9a0b
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--966e98f6-1460-4305-8993-57ee3f3f5654
Certfa Charming Kitten January 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98d076a5-9640-4337-a5a0-27c0c8a3374b
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · FireEye APT35 2018 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e0ca319-ad80-48f8-812e-fe7f9e0e77c4
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0108
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f5f1262-17a7-443e-a531-c9048a91ac8d
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a26397b4-7959-40d7-953c-c2afec8a1f80
DFIR Report APT35 ProxyShell March 2022 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4c59c09-2abd-4c49-8156-0ccc9214b66e
Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1114.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad278368-be64-497f-abc3-024ee8447ef8
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b35cd29e-1439-4f7a-a81e-44d4db29cd8b
DFIR Phosphorus November 2021 · Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1686.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3bfde12-f470-46fc-abb3-dded4d92b5c5
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5cd5028-8d4c-4564-921e-be3a34a5212d
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b60dcc78-83b0-4fe2-b874-6f22f99b6087
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1114.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6336d7c-e869-4491-9e8a-5ea5847a58ae
FireEye APT35 2018ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8bb65e7-3846-4b41-8594-16409a94aa8d
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1205923-690a-4bfb-9116-0a60eb931b26
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c235df18-28b1-48f9-bcfb-38f671005b5e
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4b6c967-54d8-4ba5-9016-5d0ef0b6cc0b
Certfa Charming Kitten January 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca948787-ea4b-4022-be96-8baf0ccff834
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cacbb779-a901-470f-9bb2-cc2d98088713
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cace8bcc-ab98-49b7-83c1-7b0b99022f02
Cybereason PowerLess February 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0192
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cde73e1c-da81-4673-a161-49693b45cd48
Secureworks Cobalt Gypsy Feb 2017 · Unit 42 Magic Hound Feb 2017 · FireEye APT35 2018ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0186
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf9f6e3b-b029-4edd-b53d-7f5981bd2302
ClearSky Charming Kitten Dec 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfbff9fe-2d62-4d80-b7b8-b35e84189803
DFIR Phosphorus November 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1589
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0946a00-610b-44d3-aec6-be292cfac52a
Proofpoint TA453 July2021