Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0059
MITRE ATT&CK Group

Magic Hound (G0059)

TA453COBALT ILLUSIONCharming KittenITG18PhosphorusNewscasterAPT35Mint Sandstorm
ShareXLinkedInRedditHN

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)

▪Techniques used (78)

T1056.001KeyloggingT1567Exfiltration Over Web ServiceT1589.001Credentials

▪Software used (13)

S0039NettoolS0357Impackettool
G0059 on MITRE ATT&CK →
T1547.001Registry Run Keys / Startup Folder
T1059.001PowerShell
T1016.002Wi-Fi Discovery
T1588.002Tool
T1584.001Domains
T1059.003Windows Command Shell
T1572Protocol Tunneling
T1585.002Email Accounts
T1591.001Determine Physical Locations
T1071Application Layer Protocol
T1071.001Web Protocols
T1486Data Encrypted for Impact
T1016.001Internet Connection Discovery
T1586.002Email Accounts
T1053.005Scheduled Task
T1592.002Software
T1021.001Remote Desktop Protocol
T1105Ingress Tool Transfer
T1190Exploit Public-Facing Application
T1204.002Malicious File
T1218.011Rundll32
T1027.010Command Obfuscation
T1046Network Service Discovery
T1590.005IP Addresses
T1113Screen Capture
T1573Encrypted Channel
T1059.005Visual Basic
T1685.001Disable or Modify Windows Event Log
T1595.002Vulnerability Scanning
T1036.010Masquerade Account Name
T1589.002Email Addresses
T1204.001Malicious Link
T1102.002Bidirectional Communication
T1033System Owner/User Discovery
T1098.002Additional Email Delegate Permissions
T1070.004File Deletion
T1027.013Encrypted/Encoded File
T1566.002Spearphishing Link
T1078.001Default Accounts
T1083File and Directory Discovery
T1016System Network Configuration Discovery
T1036.005Match Legitimate Resource Name or Location
T1098.007Additional Local or Domain Groups
T1598.003Spearphishing Link
T1049System Network Connections Discovery
T1114Email Collection
T1003.001LSASS Memory
T1570Lateral Tool Transfer
T1136.001Local Account
T1057Process Discovery
T1114.002Remote Email Collection
T1571Non-Standard Port
T1686.003Windows Host Firewall
T1070.003Clear Command History
T1082System Information Discovery
T1114.001Local Email Collection
T1505.003Web Shell
T1090Proxy
T1036.004Masquerade Task or Service
T1583.001Domains
T1018Remote System Discovery
T1112Modify Registry
T1482Domain Trust Discovery
T1589Gather Victim Identity Information
T1078.002Domain Accounts
T1566.003Spearphishing via Service
T1560.001Archive via Utility
T1585.001Social Media Accounts
T1564.003Hidden Window
T1005Data from Local System
T1047Windows Management Instrumentation
T1583.006Web Services
T1685Disable or Modify Tools
T1189Drive-by Compromise
T1087.003Email Account
S0097Pingtool
S0674CharmPowermalware
S1144FRPtool
S0002Mimikatztool
S0096Systeminfotool
S0100ipconfigtool
S0108netshtool
S1012PowerLessmalware
S0192Pupytool
S0186DownPapermalware
S0029PsExectool

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.