G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
Security context for executives and security teams
G0059: Magic Hound describes [Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back...
Executive priority
G0059: Magic Hound is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate G0059: Magic Hound by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether G0059: Magic Hound appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1056.001 | KeyloggingSub-technique | Magic Hound malware is capable of keylogging.[6] |
| Enterprise | T1567 | Exfiltration Over Web Service | Magic Hound has used the Telegram API `sendMessage` to relay data on compromised devices.CitationGoogle Iran Threats October 2021 |
| Enterprise | T1589.001 | CredentialsSub-technique | Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.[7]CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | Magic Hound malware has used Registry Run keys to establish persistence.[6]CitationDFIR Phosphorus November 2021CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1059.001 | PowerShellSub-technique | Magic Hound has used PowerShell for execution and privilege escalation.[6][1]CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1016.002 | Wi-Fi DiscoverySub-technique | Magic Hound has collected names and passwords of all Wi-Fi networks to which a device has previously connected.[8] |
| Enterprise | T1588.002 | ToolSub-technique | |
| Enterprise | T1584.001 | DomainsSub-technique | Magic Hound has used compromised domains to host links targeted to specific phishing victims.[2][5][3]CitationGoogle Iran Threats October 2021 |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | Magic Hound has used the command-line interface for code execution.[6]CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1572 | Protocol Tunneling | Magic Hound has used Plink to tunnel RDP over SSH.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1585.002 | Email AccountsSub-technique | Magic Hound has established email accounts using fake personas for spearphishing operations.[7][9] |
| Enterprise | T1591.001 | Determine Physical LocationsSub-technique | Magic Hound has collected location information from visitors to their phishing sites.CitationGoogle Iran Threats October 2021 |
| Enterprise | T1071 | Application Layer Protocol | Magic Hound malware has used IRC for C2.[6]CitationDFIR Phosphorus November 2021 |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Magic Hound has used HTTP for C2.[6]CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1486 | Data Encrypted for Impact | Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations. CitationDFIR Phosphorus November 2021CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1016.001 | Internet Connection DiscoverySub-technique | Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1586.002 | Email AccountsSub-technique | Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.[7] |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | Magic Hound has used scheduled tasks to establish persistence and execution.CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1592.002 | SoftwareSub-technique | Magic Hound has captured the user-agent strings from visitors to their phishing sites.CitationGoogle Iran Threats October 2021 |
| Enterprise | T1021.001 | Remote Desktop ProtocolSub-technique | Magic Hound has used Remote Desktop Services to copy tools on targeted systems.CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1087.003 | Email AccountSub-technique | Magic Hound has used Powershell to discover email accounts.CitationDFIR Report APT35 ProxyShell March 2022 |
| Enterprise | T1105 | Ingress Tool Transfer | Magic Hound has downloaded additional code and files from servers onto victims.[6]CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1190 | Exploit Public-Facing Application | Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).[8]CitationDFIR Report APT35 ProxyShell March 2022CitationCybereason PowerLess February 2022CitationDFIR Phosphorus November 2021CitationMicrosoft Iranian Threat Actor Trends November 2021CitationMicrosoft Log4j Vulnerability Exploitation December 2021 |
| Enterprise | T1204.002 | Malicious FileSub-technique | Magic Hound has attempted to lure victims into opening malicious email attachments.[2] |
| Enterprise | T1218.011 | Rundll32Sub-technique | Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.CitationDFIR Report APT35 ProxyShell March 2022 |
| Enterprise | T1027.010 | Command ObfuscationSub-technique | Magic Hound has used base64-encoded commands.[6]CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1046 | Network Service Discovery | Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1590.005 | IP AddressesSub-technique | Magic Hound has captured the IP addresses of visitors to their phishing sites.CitationGoogle Iran Threats October 2021 |
| Enterprise | T1113 | Screen Capture | Magic Hound malware can take a screenshot and upload the file to its C2 server.[6] |
| Enterprise | T1573 | Encrypted Channel | Magic Hound has used an encrypted http proxy in C2 communications.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1059.005 | Visual BasicSub-technique | Magic Hound malware has used VBS scripts for execution.[6] |
| Enterprise | T1685.001 | Disable or Modify Windows Event LogSub-technique | Magic Hound has executed scripts to disable the event log service.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1595.002 | Vulnerability ScanningSub-technique | Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.[8]CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1036.010 | Masquerade Account NameSub-technique | Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.CitationDFIR Report APT35 ProxyShell March 2022CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1589.002 | Email AddressesSub-technique | Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.[5]CitationGoogle Iran Threats October 2021 |
| Enterprise | T1204.001 | Malicious LinkSub-technique | Magic Hound has attempted to lure victims into opening malicious links embedded in emails.[2][3] |
| Enterprise | T1102.002 | Bidirectional CommunicationSub-technique | Magic Hound malware can use a SOAP Web service to communicate with its C2 server.[6] |
| Enterprise | T1033 | System Owner/User Discovery | Magic Hound malware has obtained the victim username and sent it to the C2 server.[6]CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1098.002 | Additional Email Delegate PermissionsSub-technique | Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.[1] |
| Enterprise | T1070.004 | File DeletionSub-technique | Magic Hound has deleted and overwrote files to cover tracks.[6][1]CitationDFIR Phosphorus November 2021 |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.[6]CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1566.002 | Spearphishing LinkSub-technique | Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.CitationSecureworks Cobalt Gypsy Feb 2017[2][3]CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1078.001 | Default AccountsSub-technique | Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1083 | File and Directory Discovery | Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.[6] |
| Enterprise | T1016 | System Network Configuration Discovery | Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.[6]CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | Magic Hound has used `dllhost.exe` to mask Fast Reverse Proxy (FRP) and `MicrosoftOutLookUpdater.exe` for Plink.CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1098.007 | Additional Local or Domain GroupsSub-technique | Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.CitationDFIR Report APT35 ProxyShell March 2022 |
| Enterprise | T1598.003 | Spearphishing LinkSub-technique | Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.[3][2][9][5]CitationGoogle Iran Threats October 2021CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1049 | System Network Connections Discovery | Magic Hound has used quser.exe to identify existing RDP connections.CitationDFIR Report APT35 ProxyShell March 2022 |
| Enterprise | T1114 | Email Collection | Magic Hound has compromised email credentials in order to steal sensitive data.[3] |
| Enterprise | T1003.001 | LSASS MemorySub-technique | Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.[1]CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1570 | Lateral Tool Transfer | Magic Hound has copied tools within a compromised network using RDP.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1136.001 | Local AccountSub-technique | Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.CitationDFIR Report APT35 ProxyShell March 2022CitationMicrosoft Iranian Threat Actor Trends November 2021 |
| Enterprise | T1057 | Process Discovery | Magic Hound malware can list running processes.[6] |
| Enterprise | T1114.002 | Remote Email CollectionSub-technique | Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1571 | Non-Standard Port | Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.[6]CitationDFIR Phosphorus November 2021 |
| Enterprise | T1686.003 | Windows Host FirewallSub-technique | Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1070.003 | Clear Command HistorySub-technique | Magic Hound has removed mailbox export requests from compromised Exchange servers.CitationDFIR Report APT35 ProxyShell March 2022 |
| Enterprise | T1082 | System Information Discovery | Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.[6]CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1114.001 | Local Email CollectionSub-technique | Magic Hound has collected .PST archives.[1] |
| Enterprise | T1505.003 | Web ShellSub-technique | Magic Hound has used multiple web shells to gain execution.CitationDFIR Report APT35 ProxyShell March 2022CitationDFIR Phosphorus November 2021 |
| Enterprise | T1090 | Proxy | Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1036.004 | Masquerade Task or ServiceSub-technique | Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1583.001 | DomainsSub-technique | Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.[3] |
| Enterprise | T1018 | Remote System Discovery | Magic Hound has used Ping for discovery on targeted networks.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1112 | Modify Registry | Magic Hound has modified Registry settings for security tools.CitationDFIR Report APT35 ProxyShell March 2022 |
| Enterprise | T1482 | Domain Trust Discovery | Magic Hound has used a web shell to execute `nltest /trusted_domains` to identify trust relationships.CitationDFIR Phosphorus November 2021 |
| Enterprise | T1589 | Gather Victim Identity Information | Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.[5] |
Groups, software, and campaigns
S0039: Net
The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]
Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
S0357: Impacket
S0097: Ping
S0674: CharmPower
CharmPower is a PowerShell-based, modular backdoor that has been used by Magic Hound since at least 2022.[1]
S1144: FRP
FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.[1][2][3][4]
S0002: Mimikatz
S0096: Systeminfo
Systeminfo is a Windows utility that can be used to gather detailed information about a computer. [1]
S0100: ipconfig
S0108: netsh
S1012: PowerLess
PowerLess is a PowerShell-based modular backdoor that has been used by Magic Hound since at least 2022.[1]
S0192: Pupy
Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. [1] It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). [1] Pupy is publicly available on GitHub. [1]
S0186: DownPaper
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 6.1 | Current bundle | 736c37fce3f2… | ||
| 19.2 | 6.1 | Older bundle | 736c37fce3f2… | ||
| 19.1 | 6.1 | Older bundle | b29c155c46a7… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]FireEye APT35 2018
Mandiant. (2018). Mandiant M-Trends 2018. Retrieved November 17, 2024.
Open source URL - [2]ClearSky Kittens Back 3 August 2020
ClearSky Research Team. (2020, August 1). The Kittens Are Back in Town 3 - Charming Kitten Campaign Evolved and Deploying Spear-Phishing link by WhatsApp. Retrieved April 21, 2021.
Open source URL - [3]Certfa Charming Kitten January 2021
Certfa Labs. (2021, January 8). Charming Kitten’s Christmas Gift. Retrieved May 3, 2021.
Open source URL - [4]Secureworks COBALT ILLUSION Threat Profile
Secureworks. (n.d.). COBALT ILLUSION Threat Profile. Retrieved April 14, 2021.
Open source URL - [5]Proofpoint TA453 July2021
Miller, J. et al. (2021, July 13). Operation SpoofedScholars: A Conversation with TA453. Retrieved August 18, 2021.
Open source URL - [6]Unit 42 Magic Hound Feb 2017
Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
Open source URL - [7]IBM ITG18 2020
Wikoff, A. Emerson, R. (2020, July 16). New Research Exposes Iranian Threat Group Operations. Retrieved March 8, 2021.
Open source URL - [8]Check Point APT35 CharmPower January 2022
Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
Open source URL - [9]Proofpoint TA453 March 2021
Miller, J. et al. (2021, March 30). BadBlood: TA453 Targets US and Israeli Medical Research Personnel in Credential Phishing Campaigns. Retrieved May 4, 2021.
Open source URL - [10]ClearSky Charming Kitten Dec 2017
ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017.
- [11]APT35
(Citation: FireEye APT35 2018)(Citation: Certfa Charming Kitten January 2021)(Citation: Check Point APT35 CharmPower January 2022)
- [12]COBALT ILLUSION
(Citation: Secureworks COBALT ILLUSION Threat Profile)
- [13]Charming Kitten
(Citation: ClearSky Charming Kitten Dec 2017)(Citation: Eweek Newscaster and Charming Kitten May 2014)(Citation: ClearSky Kittens Back 2 Oct 2019)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Proofpoint TA453 March 2021)(Citation: Check Point APT35 CharmPower January 2022)
- [14]ClearSky Kittens Back 2 Oct 2019
ClearSky Research Team. (2019, October 1). The Kittens Are Back in Town2 - Charming Kitten Campaign KeepsGoing on, Using New Impersonation Methods. Retrieved April 21, 2021.
Open source URL - [15]Eweek Newscaster and Charming Kitten May 2014
Kerner, S. (2014, May 29). Newscaster Threat Uses Social Media for Intelligence Gathering. Retrieved April 14, 2021.
Open source URL - [16]ITG18
(Citation: IBM ITG18 2020)
- [17]Magic Hound
(Citation: Unit 42 Magic Hound Feb 2017)
- [18]Microsoft Phosphorus Mar 2019
Burt, T. (2019, March 27). New steps to protect customers from hacking. Retrieved May 27, 2020.
Open source URL - [19]Microsoft Phosphorus Oct 2020
Burt, T. (2020, October 28). Cyberattacks target international conference attendees. Retrieved March 8, 2021.
Open source URL - [20]Microsoft Threat Actor Naming July 2023
Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Open source URL - [21]Mint Sandstorm
(Citation: Microsoft Threat Actor Naming July 2023)
- [22]Newscaster
Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the older attack campaign called Newscaster (aka Newscasters).(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)
- [23]Phosphorus
(Citation: Microsoft Phosphorus Mar 2019)(Citation: Microsoft Phosphorus Oct 2020)(Citation: US District Court of DC Phosphorus Complaint 2019)(Citation: Certfa Charming Kitten January 2021)(Citation: Proofpoint TA453 March 2021)(Citation: Check Point APT35 CharmPower January 2022)
- [24]TA453
(Citation: Proofpoint TA453 March 2021)(Citation: Proofpoint TA453 July2021)(Citation: Check Point APT35 CharmPower January 2022)
- [25]US District Court of DC Phosphorus Complaint 2019
US District Court of DC. (2019, March 14). MICROSOFT CORPORATION v. JOHN DOES 1-2, CONTROLLING A COMPUTER NETWORK AND THEREBY INJURING PLAINTIFF AND ITS CUSTOMERS. Retrieved March 8, 2021.
Open source URL - [26]mitre-attackG0059Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.