Magic Hound

Names and who uses them

• Magic HoundOur name
• Charming KittenClearSky
• APT35Mandiant
• Mint SandstormMicrosoft
• PhosphorusMicrosoft
• ITG18MITRE ATT&CK
• NewscasterPalo Alto Networks
• TA453Proofpoint
• COBALT ILLUSIONSecureworks

Targets

Sectors: Government, Defence, Education, Media

Regions: Europe, Middle East

Known techniques

• T1003.001LSASS Memory
• T1005Data from Local System
• T1016System Network Configuration Discovery
• T1016.001Internet Connection Discovery
• T1016.002Wi-Fi Discovery
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1027.010Command Obfuscation
• T1027.013Encrypted/Encoded File
• T1033System Owner/User Discovery
• T1036.004Masquerade Task or Service
• T1036.005Match Legitimate Resource Name or Location
• T1036.010Masquerade Account Name
• T1046Network Service Discovery
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1053.005Scheduled Task
• T1056.001Keylogging
• T1057Process Discovery
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1070.003Clear Command History
• T1070.004File Deletion
• T1071Application Layer Protocol
• T1071.001Web Protocols
• T1078.001Default Accounts
• T1078.002Domain Accounts
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1087.003Email Account
• T1090Proxy
• T1098.002Additional Email Delegate Permissions
• T1098.007Additional Local or Domain Groups
• T1102.002Bidirectional Communication
• T1105Ingress Tool Transfer
• T1112Modify Registry
• T1113Screen Capture
• T1114Email Collection
• T1114.001Local Email Collection

Malware and tools used