Trusted Design

Magic Hound

G0059 · MITRE Pageへのリンク

脅威アクターの詳細

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)

別名・別称

Magic Hound
TA453
COBALT ILLUSION
Charming Kitten
ITG18
Phosphorus
Newscaster
APT35
Mint Sandstorm

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1047 - Windows Management Instrumentation
• T1113 - Screen Capture
• T1033 - System Owner/User Discovery
• T1218.011 - Rundll32
• T1056.001 - Keylogging
• T1027.013 - Encrypted/Encoded File
• T1590.005 - IP Addresses
• T1016.001 - Internet Connection Discovery
• T1114 - Email Collection
• T1036.005 - Match Legitimate Resource Name or Location
• T1114.001 - Local Email Collection
• T1204.002 - Malicious File
• T1566.002 - Spearphishing Link
• T1598.003 - Spearphishing Link
• T1082 - System Information Discovery
• T1071 - Application Layer Protocol
• T1070.003 - Clear Command History
• T1005 - Data from Local System
• T1562 - Impair Defenses
• T1586.002 - Email Accounts
• T1098.007 - Additional Local or Domain Groups
• T1190 - Exploit Public-Facing Application
• T1567 - Exfiltration Over Web Service
• T1583.001 - Domains
• T1016.002 - Wi-Fi Discovery
• T1087.003 - Email Account
• T1562.002 - Disable Windows Event Logging
• T1572 - Protocol Tunneling
• T1589 - Gather Victim Identity Information
• T1562.004 - Disable or Modify System Firewall
• T1595.002 - Vulnerability Scanning
• T1112 - Modify Registry
• T1505.003 - Web Shell
• T1078.001 - Default Accounts
• T1136.001 - Local Account
• T1585.002 - Email Accounts
• T1003.001 - LSASS Memory
• T1589.002 - Email Addresses
• T1016 - System Network Configuration Discovery
• T1090 - Proxy
• T1482 - Domain Trust Discovery
• T1083 - File and Directory Discovery
• T1036.004 - Masquerade Task or Service
• T1049 - System Network Connections Discovery
• T1583.006 - Web Services
• T1057 - Process Discovery
• T1059.001 - PowerShell
• T1547.001 - Registry Run Keys / Startup Folder
• T1588.002 - Tool
• T1562.001 - Disable or Modify Tools
• T1571 - Non-Standard Port
• T1585.001 - Social Media Accounts
• T1114.002 - Remote Email Collection
• T1486 - Data Encrypted for Impact
• T1573 - Encrypted Channel
• T1592.002 - Software
• T1589.001 - Credentials
• T1102.002 - Bidirectional Communication
• T1570 - Lateral Tool Transfer
• T1078.002 - Domain Accounts
• T1564.003 - Hidden Window
• T1059.003 - Windows Command Shell
• T1036.010 - Masquerade Account Name
• T1027.010 - Command Obfuscation
• T1070.004 - File Deletion
• T1189 - Drive-by Compromise
• T1071.001 - Web Protocols
• T1059.005 - Visual Basic
• T1018 - Remote System Discovery
• T1046 - Network Service Discovery
• T1105 - Ingress Tool Transfer
• T1098.002 - Additional Email Delegate Permissions
• T1021.001 - Remote Desktop Protocol
• T1591.001 - Determine Physical Locations
• T1204.001 - Malicious Link
• T1566.003 - Spearphishing via Service
• T1584.001 - Domains

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1189)
• CVE-2015-5749 (T1486)
• CVE-2016-1898 (T1204.001)
• CVE-2016-1897 (T1204.001)
• CVE-2015-7261 (T1204.001)
• CVE-2015-6036 (T1204.001)
• CVE-2015-7262 (T1598.003)
• CVE-2015-0932 (T1562.004)
• CVE-2010-3081 (T1046)
• CVE-2017-16929 (T1204.001)
• CVE-2025-31125 (T1204.001)
• CVE-2025-68645 (T1204.001)
• CVE-2014-4114 (T1204.001)
• CVE-2017-0143 (T1566.003)
• CVE-2013-3906 (T1027.010)
• CVE-2013-6282 (T1486)
• CVE-2012-1856 (T1204.001)
• CVE-2014-6332 (T1204.001)
• CVE-2012-0158 (T1204.001)
• CVE-2015-1701 (T1204.001)
• CVE-2012-4969 (T1204.001)
• CVE-2014-1776 (T1204.001)
• CVE-2013-3660 (T1204.001)
• CVE-2010-0806 (T1204.001)
• CVE-2015-2360 (T1204.001)
• CVE-2010-4398 (T1204.001)
• CVE-2025-55182 (T1204.001)
• CVE-2023-1389 (T1566.003)
• CVE-2025-13928 (T1591.001)
• CVE-2025-24893 (T1566.003)
• CVE-2025-34026 (T1204.001)
• CVE-2025-55184 (T1204.001)
• CVE-2015-1770 (T1204.001)
• CVE-2015-2545 (T1204.001)
• CVE-2015-2546 (T1566.003)
• CVE-2017-0199 (T1204.001)
• CVE-2017-12149 (T1204.001)
• CVE-2015-2424 (T1204.001)
• CVE-2015-0097 (T1204.001)
• CVE-2014-1761 (T1592.002)
• CVE-2015-2502 (T1204.001)
• CVE-2014-6271 (T1566.003)
• CVE-2014-4113 (T1204.001)
• CVE-2012-1889 (T1598.003)
• CVE-2015-1641 (T1204.001)
• CVE-2017-0263 (T1566.003)
• CVE-2017-0261 (T1204.001)
• CVE-2017-0262 (T1204.001)
• CVE-2016-6532 (T1003.001)
• CVE-2017-3212 (T1589.001)
• CVE-2014-6352 (T1059.005)
• CVE-2015-0016 (T1204.001)
• CVE-2010-3333 (T1204.001)
• CVE-2012-4792 (T1204.001)
• CVE-2014-0322 (T1204.001)
• CVE-2013-0074 (T1204.001)
• CVE-2013-2551 (T1204.001)
• CVE-2012-1876 (T1204.001)
• CVE-2015-0057 (T1204.001)
• CVE-2012-2539 (T1204.001)
• CVE-2015-0071 (T1204.001)
• CVE-2015-1761 (T1204.001)
• CVE-2013-7331 (T1018)
• CVE-2014-4148 (T1204.001)
• CVE-2011-3402 (T1204.001)
• CVE-2014-6324 (T1204.001)
• CVE-2015-2426 (T1204.001)
• CVE-2008-1436 (T1486)
• CVE-2010-0232 (T1204.001)
• CVE-2015-2387 (T1204.001)
• CVE-2009-3129 (T1566.003)
• CVE-2010-2572 (T1204.001)
• CVE-2011-1255 (T1204.001)
• CVE-2011-0611 (T1566.003)
• CVE-2017-8570 (T1566.003)
• CVE-2015-2419 (T1204.001)
• CVE-2016-0189 (T1204.001)
• CVE-2017-0001 (T1566.003)
• CVE-2025-55183 (T1204.001)
• CVE-2010-0188 (T1204.001)
• CVE-2010-2884 (T1059.003)
• CVE-2013-0640 (T1059.003)
• CVE-2015-5119 (T1204.001)
• CVE-2015-5122 (T1204.001)
• CVE-2015-1427 (T1566.003)
• CVE-2015-3785 (T1486)
• CVE-2015-5897 (T1562.001)
• CVE-2015-7645 (T1204.001)
• CVE-2015-3043 (T1204.001)
• CVE-2015-3456 (T1486)
• CVE-2015-3090 (T1566.003)
• CVE-2010-1553 (T1566.003)
• CVE-2015-3113 (T1486)
• CVE-2015-2590 (T1204.001)
• CVE-2015-5477 (T1036.004)
• CVE-2013-2094 (T1204.001)
• CVE-2015-8562 (T1204.001)
• CVE-2015-7808 (T1598.003)
• CVE-2016-1990 (T1083)
• CVE-2016-1991 (T1083)
• CVE-2016-1010 (T1566.003)
• CVE-2016-1019 (T1566.003)
• CVE-2016-0984 (T1204.001)
• CVE-2016-1001 (T1566.003)
• CVE-2016-0998 (T1566.003)
• CVE-2015-0313 (T1204.001)
• CVE-2015-0359 (T1204.001)
• CVE-2014-0329 (T1204.001)
• CVE-2015-5130 (T1566.003)
• CVE-2015-5134 (T1566.003)
• CVE-2015-5539 (T1566.003)
• CVE-2015-5557 (T1566.003)
• CVE-2015-5563 (T1566.003)
• CVE-2015-5559 (T1566.003)
• CVE-2015-5540 (T1566.003)
• CVE-2015-5561 (T1566.003)
• CVE-2015-5551 (T1566.003)
• CVE-2015-5564 (T1566.003)
• CVE-2015-5565 (T1566.003)
• CVE-2015-5550 (T1566.003)
• CVE-2015-5566 (T1566.003)
• CVE-2015-5127 (T1566.003)
• CVE-2015-5556 (T1566.003)
• CVE-2015-3628 (T1486)
• CVE-2015-6034 (T1562.001)
• CVE-2015-2852 (T1204.001)
• CVE-2015-2854 (T1204.001)
• CVE-2015-2853 (T1204.001)
• CVE-2015-7755 (T1486)
• CVE-2016-1287 (T1566.003)
• CVE-2015-6022 (T1204.001)
• CVE-2015-8286 (T1592.002)
• CVE-2015-8287 (T1016)
• CVE-2016-1562 (T1562.001)
• CVE-2016-2342 (T1046)
• CVE-2016-2343 (T1486)
• CVE-2016-9494 (T1204.001)
• CVE-2016-9496 (T1204.001)
• CVE-2016-9495 (T1204.001)
• CVE-2025-61882 (T1598.003)
• CVE-2015-0311 (T1204.001)
• CVE-2012-0056 (T1486)
• CVE-2012-3213 (T1204.001)
• CVE-2012-1258 (T1046)
• CVE-2015-0336 (T1566.003)
• CVE-2011-3544 (T1204.001)
• CVE-2014-3153 (T1562.001)
• CVE-2014-7911 (T1486)
• CVE-2014-4322 (T1486)
• CVE-2015-3636 (T1562.001)
• CVE-2015-3105 (T1486)
• CVE-2014-0497 (T1486)
• CVE-2014-8361 (T1071.001)
• CVE-2017-17215 (T1204.001)
• CVE-2012-0507 (T1566.003)
• CVE-2013-2465 (T1566.003)
• CVE-2014-8439 (T1046)
• CVE-2014-0569 (T1589.001)
• CVE-2014-0515 (T1486)
• CVE-2015-0310 (T1486)
• CVE-2012-4681 (T1204.001)
• CVE-2014-0556 (T1566.003)
• CVE-2015-5560 (T1589.001)
• CVE-2014-9163 (T1046)
• CVE-2012-1723 (T1204.001)
• CVE-2014-8440 (T1204.001)
• CVE-2010-1297 (T1204.001)
• CVE-2010-2883 (T1046)
• CVE-2013-0634 (T1566.003)
• CVE-2014-7247 (T1566.003)
• CVE-2012-5054 (T1486)
• CVE-2013-2678 (T1204.001)
• CVE-2010-0738 (T1566.003)
• CVE-2013-0641 (T1059.003)
• CVE-2014-3393 (T1566.003)
• CVE-2012-6422 (T1566.003)
• CVE-2013-2595 (T1486)
• CVE-2014-2273 (T1562.001)
• CVE-2015-4902 (T1566.003)
• CVE-2013-5990 (T1566.003)
• CVE-2012-0611 (T1204.001)
• CVE-2016-4117 (T1486)
• CVE-2017-7255 (T1018)
• CVE-2025-13335 (T1591.001)
• CVE-2025-13927 (T1591.001)
• CVE-2025-54313 (T1591.001)
• CVE-2026-0723 (T1591.001)
• CVE-2026-1102 (T1591.001)
• CVE-2026-20127 (T1204.001)
• CVE-2025-66478 (T1566.003)
• CVE-2014-3897 (T1204.001)
• CVE-2015-6585 (T1585.002)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る