Cyb3rWard0g/ATTCKGroups huggingface dataset:
Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.(Citation: FireEye APT40 March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Leviathan has sent spearphishing email links attempting to get a user to click.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.(Citation: FireEye APT40 March 2019)(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Leviathan has targeted RDP credentials and used it to move through the victim environment.(Citation: FireEye APT40 March 2019) |
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Leviathan has used publicly available tools to dump password hashes, including

HOMEFRY.(Citation: FireEye APT40 March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

Leviathan used ssh for internal reconnaissance.(Citation: FireEye APT40 March 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|
Leviathan used ssh for internal reconnaissance.(Citation: FireEye APT40 March 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Leviathan has used PowerShell for execution.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Leviathan has used WMI for execution.(Citation: Proofpoint Leviathan Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.003|One-Way Communication|

Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.(Citation: FireEye Periscope March 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|
Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)|
|mitre-attack|enterprise-attack|Windows|T1197|BITS Jobs|

Leviathan has used

BITSAdmin to download additional tools.(Citation: FireEye Periscope March 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Leviathan has sent spearphishing attachments attempting to get a user to click.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.(Citation: Proofpoint Leviathan Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Leviathan has used WMI for persistence.(Citation: FireEye Periscope March 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.(Citation: Proofpoint Leviathan Oct 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Leviathan has used VBScript.(Citation: Proofpoint Leviathan Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|
Leviathan has used VBScript.(Citation: Proofpoint Leviathan Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

Leviathan has used regsvr32 for execution.(Citation: Proofpoint Leviathan Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Leviathan has obfuscated code using base64 and gzip compression.(Citation: Proofpoint Leviathan Oct 2017)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Leviathan has used stolen code signing certificates to sign malware.(Citation: FireEye Periscope March 2018)(Citation: FireEye APT40 March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Leviathan has downloaded additional scripts and files from adversary-controlled servers.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.009|Shortcut Modification|

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)|
LuminousMoth - G1014

Created: 2023-02-23T15:31:38.829Z

Modified: 2023-04-17T21:49:16.371Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet,Zaw Min Htun, @Z3TAE

Aliases

LuminousMoth

Description

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)

Techniques Used

LuminousMoth has signed their malware with a valid digital signature.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

LuminousMoth has hosted malicious payloads on Dropbox.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|PRE|T1608.005|Link Target|

LuminousMoth has created a link to a Dropbox file that has been used in their spear-phishing operations.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

LuminousMoth has used unique malware for information theft and exfiltration.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|
LuminousMoth has used malware that adds Registry keys for persistence.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

LuminousMoth has used malware that exfiltrates stolen data to its C2 server.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

LuminousMoth has created scheduled tasks to establish persistence for their tools.(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1030|Data Transfer Size Limits|

LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

LuminousMoth has used a malicious DLL to collect the username from compromised hosts.(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

LuminousMoth has collected files and data from compromised machines.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|
LuminousMoth has obtained an ARP spoofing tool from GitHub.(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

LuminousMoth has manually archived stolen files from victim machines before exfiltration.(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|PRE|T1608.004|Drive-by Target|

LuminousMoth has redirected compromised machines to an actor-controlled webpage through HTML injection.(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1557.002|ARP Cache Poisoning|

LuminousMoth has used ARP spoofing to redirect a compromised machine to an actor-controlled website.(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

LuminousMoth has exfiltrated data to Google Drive.(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

LuminousMoth has downloaded additional malware and tools onto a compromised host.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

LuminousMoth has used HTTP for C2.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|
LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Windows|T1091|Replication Through Removable Media|

LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1539|Steal Web Session Cookie|

LuminousMoth has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

LuminousMoth has disguised their exfiltration malware as

LuminousMoth has used malicious DLLs that setup persistence in the Registry Key

LuminousMoth has used legitimate executables such as

LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

LuminousMoth has sent spearphishing emails containing a malicious Dropbox download link.(Citation: Kaspersky LuminousMoth July 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.004|Digital Certificates|

LuminousMoth has used a valid digital certificate for some of their malware.(Citation: Kaspersky LuminousMoth July 2021) |
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

LuminousMoth has obtained and used malware such as
LuminousMoth has obtained and used malware such as

Cobalt Strike.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)|
Machete - G0095

Created: 2019-09-13T12:37:10.394Z

Modified: 2021-10-06T19:26:47.988Z

Contributors: Matias Nicolas Porolli, ESET

Aliases

Machete,APT-C-43,El Machete

Description

Machete is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. Machete generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies.(Citation: Cylance Machete Mar 2017)(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)(Citation: 360 Machete Sep 2020)

Techniques Used

Machete has distributed

Machete through a fake blog website.(Citation: Securelist Machete Aug 2014)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Machete has embedded malicious macros within spearphishing attachments to download additional files.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Machete has used batch files to initiate additional downloads of malicious files.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.007|Msiexec|

Machete has used msiexec to install the

Machete malware.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Machete's

Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Machete has created scheduled tasks to maintain
Machete has created scheduled tasks to maintain

Machete's persistence.(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.(Citation: Cylance Machete Mar 2017)(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.(Citation: Cylance Machete Mar 2017)(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Machete used multiple compiled Python scripts on the victim’s system.

Machete's main backdoor

Machete is also written in Python.(Citation: Cylance Machete Mar 2017)(Citation: ESET Machete July 2019)(Citation: 360 Machete Sep 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.(Citation: Cylance Machete Mar 2017)(Citation: ESET Machete July 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Machete has delivered spearphishing emails that contain a zipped file with malicious contents.(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)(Citation: 360 Machete Sep 2020)|
Magic Hound - G0059

Created: 2018-01-16T16:13:52.465Z

Modified: 2023-01-13T21:18:18.077Z

Contributors: Anastasios Pingios,Bryan Lee,Daniyal Naeem, BT Security

Aliases

Magic Hound,TA453,COBALT ILLUSION,Charming Kitten,ITG18,Phosphorus,Newscaster,APT35

Description

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)

Techniques Used

Magic Hound has used base64-encoded commands.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,SaaS,Network|T1098|Account Manipulation|

Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

Magic Hound has copied tools within a compromised network using RDP.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|
Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.(Citation: DFIR Phosphorus November 2021) |
|mitre-attack|enterprise-attack|PRE|T1591.001|Determine Physical Locations|

Magic Hound has collected location information from visitors to their phishing sites.(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|Windows|T1562.002|Disable Windows Event Logging|

Magic Hound has executed scripts to disable the event log service.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows|T1482|Domain Trust Discovery|

Magic Hound has used a web shell to execute

Magic Hound has used an encrypted http proxy in C2 communications.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations. (Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

Magic Hound has used domain administrator accounts after dumping LSASS process memory.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|
Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Magic Hound has used Plink to tunnel RDP over SSH.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1078.001|Default Accounts|

Magic Hound enabled and used the default system managed account, DefaultAccount, via

Magic Hound has used

Ping for discovery on targeted networks.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|PRE|T1592.002|Software|

Magic Hound has captured the user-agent strings from visitors to their phishing sites.(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|PRE|T1590.005|IP Addresses|

Magic Hound has captured the IP addresses of visitors to their phishing sites.(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567|Exfiltration Over Web Service|

Magic Hound has used the Telegram API

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Magic Hound has used quser.exe to identify existing RDP connections.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|
Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Magic Hound has created local accounts named

Magic Hound has used Powershell to discover email accounts.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Magic Hound has used a tool to run

Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic -

Magic Hound has modified Registry settings for security tools.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1070.003|Clear Command History|

Magic Hound has removed mailbox export requests from compromised Exchange servers.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Office 365,IaaS,Linux,macOS,Containers,Network|T1562|Impair Defenses|

Magic Hound has disabled LSA protection on compromised hosts using

Magic Hound has used

Magic Hound has used scheduled tasks to establish persistence and execution.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|
Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Magic Hound has used multiple web shells to gain execution.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Magic Hound has conducted watering-hole attacks through media and magazine websites.(Citation: ClearSky Kittens Back 3 August 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

Magic Hound has acquired Amazon S3 buckets to use in C2.(Citation: Check Point APT35 CharmPower January 2022)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.(Citation: Check Point APT35 CharmPower January 2022)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|