Magic Hound

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat Iran

Primary Aliases: APT35 Charming Kitten Mint Sandstorm Ajax Security

Sponsor / State Affiliation Islamic Revolutionary Guard Corps (IRGC)

Primary Motivation Geopolitical espionage, political influence, silencing dissidents, and supporting Iranian foreign policy objectives.

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

GCC Critical Infrastructure Pre-positioning, Internal Operational Leak Disclosure, BellaCPP Implant Deployment

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Government Military Aerospace Defense Energy Media Academia NGOs Biotech Telecommunications Financial Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (10 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Sophisticated spear-phishing

Credential Access & Discovery 2

T1003 Social engineering via fake personas (journalists, academics, NGOs)

T1003 Credential harvesting

Lateral Movement & Collection 1

T1021 Cloud-centric identity intelligence collection

Command & Control 4

T1071 Honeytrap operations

T1071 Custom malware (BellaCPP, HYPERSCRAPE)

T1071 Abuse of legitimate RMM tools (Atera, AnyDesk, ScreenConnect)

T1071 Telegram-based C2 and operator notifications

Operational Techniques 2

T1000 Exploitation of enterprise vulnerabilities (e.g., ProxyShell, Exchange EWS)

T1000 AI-assisted disinformation

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Iranian APT42 and APT35 Utilizing LLMs for AI-Augmented Spear-Phishing and Tamecat Malware Deployment

Attacks and Vulnerabilities 2026-08-15

[DEEP DIVE] Iranian APT Escalation: Massive Surge in Cyber Operations Against Israeli Infrastructure

Attacks and Vulnerabilities 2026-07-06

Copied to clipboard

LINK COPIED TO CLIPBOARD