Threat Actor Profile

Magic Hound

APT35 Charming Kitten COBALT ILLUSION G0059 ITG18 Mint Sandstorm Newscaster Phosphorus TA453

⚠ Critical Threat

GCC Critical Infrastructure Pre-positioning, Internal Operational Leak Disclosure, BellaCPP Implant Deployment

Origin Iran

Sponsor Islamic Revolutionary Guard Corps (IRGC)

Motivation Geopolitical espionage, political influence, silencing dissidents, and supporting Iranian foreign policy objectives.

Target Sectors

Government Military Aerospace Defense Energy Media Academia NGOs Biotech Telecommunications Financial Critical Infrastructure

Sophisticated spear-phishing

Social engineering via fake personas (journalists, academics, NGOs)

Honeytrap operations

Credential harvesting

Exploitation of enterprise vulnerabilities (e.g., ProxyShell, Exchange EWS)

Custom malware (BellaCPP, HYPERSCRAPE)

Abuse of legitimate RMM tools (Atera, AnyDesk, ScreenConnect)

AI-assisted disinformation

Cloud-centric identity intelligence collection

Telegram-based C2 and operator notifications

CISA Advisories ↗

Attacks and Vulnerabilities 2026-07-06