S0674: CharmPower
CharmPower is a PowerShell-based, modular backdoor that has been used by Magic Hound since at least 2022.[1]
Security context for executives and security teams
S0674: CharmPower describes [CharmPower](https://attack.mitre.org/software/S0674) is a PowerShell-based, modular backdoor that has been used by [Magic Hound](https://attack.mitre.org/groups/G0059) since at least 2022.(Citation: Check Point APT35 CharmPower January 2022)
Executive priority
S0674: CharmPower is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S0674: CharmPower by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S0674: CharmPower appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
CharmPower
CharmPower is a PowerShell-based, modular backdoor that has been used by Magic Hound since at least 2022.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1112 | Modify Registry | CharmPower can remove persistence-related artifacts from the Registry.[1] |
| Enterprise | T1082 | System Information Discovery | CharmPower can enumerate the OS version and computer name on a targeted system.[1] |
| Enterprise | T1518 | Software Discovery | CharmPower can list the installed applications on a compromised host.[1] |
| Enterprise | T1048.003 | Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique | CharmPower can send victim data via FTP with credentials hardcoded in the script.[1] |
| Enterprise | T1573.001 | Symmetric CryptographySub-technique | CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.[1] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | CharmPower can decrypt downloaded modules prior to execution.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.[1] |
| Enterprise | T1102.001 | Dead Drop ResolverSub-technique | CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.[1] |
| Enterprise | T1083 | File and Directory Discovery | CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.[1] |
| Enterprise | T1016.002 | Wi-Fi DiscoverySub-technique | CharmPower can use `netsh wlan show profiles` to list specific Wi-Fi profile details.[1] |
| Enterprise | T1059.001 | PowerShellSub-technique | CharmPower can use PowerShell for payload execution and C2 communication.[1] |
| Enterprise | T1070.004 | File DeletionSub-technique | CharmPower can delete created files from a compromised system.[1] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | CharmPower can use HTTP to communicate with C2.[1] |
| Enterprise | T1008 | Fallback Channels | CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.[1] |
| Enterprise | T1057 | Process Discovery | CharmPower has the ability to list running processes through the use of `tasklist`.[1] |
| Enterprise | T1102 | Web Service | CharmPower can download additional modules from actor-controlled Amazon S3 buckets.[1] |
| Enterprise | T1005 | Data from Local System | CharmPower can collect data and files from a compromised host.[1] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | The C# implementation of the CharmPower command execution module can use |
| Enterprise | T1016 | System Network Configuration Discovery | CharmPower has the ability to use |
| Enterprise | T1113 | Screen Capture | CharmPower has the ability to capture screenshots.[1] |
| Enterprise | T1105 | Ingress Tool Transfer | CharmPower has the ability to download additional modules to a compromised host.[1] |
| Enterprise | T1132.001 | Standard EncodingSub-technique | CharmPower can send additional modules over C2 encoded with base64.[1] |
| Enterprise | T1047 | Windows Management Instrumentation | CharmPower can use `wmic` to gather information from a system.[1] |
| Enterprise | T1012 | Query Registry | CharmPower has the ability to enumerate `Uninstall` registry values.[1] |
Groups, software, and campaigns
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | 1669be2068d3… | ||
| 19.1 | 1.1 | Older bundle | 1669be2068d3… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Check Point APT35 CharmPower January 2022
Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
Open source URL - [2]mitre-attackS0674Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.