Skip to main content

OilRig and Magic Hound research intake

Two sourced campaign examples, with an explicit boundary around the original research intake.

This report has a source-reviewed core and an unresolved appendix. The combined page remains experimental, unverified overall, and currentness-unknown. The review below was performed on 2026-09-09; it establishes support for these bounded claims, not the accuracy of the original intake or present-day actor activity. See the existing editorial policy.

Contents​

Actor identity and naming boundaries​

C01 — Framework identity. MITRE tracks OilRig as G0049 and Magic Hound as G0059. Its OilRig record explains the historical consolidation of APT34 and OilRig based on additional reporting. These are framework groupings; an associated-name list is not proof that every vendor campaign has identical membership or scope. MITRE OilRig, MITRE Magic Hound.

C02 — Attribution boundary. For the second example, retain Proofpoint's campaign label TA453. Proofpoint assesses support for IRGC-IO and describes overlap with other vendors' clusters, while noting that it cannot connect individual IRGC members to TA453. This core does not collapse APT35, APT42, TA453, and Magic Hound into universally interchangeable aliases. Proofpoint, 2024.

Sourced campaign examples​

C03 — OilRig / RGDoor. Unit 42 describes a native IIS module backdoor discovered during investigation of uploads through TwoFace. The module exports RegisterModule and handles a Cookie field containing RGSESSIONID. The report separates its own test interactions from unavailable actor HTTP logs; its example installation command demonstrates a laboratory installation, not a confirmed attacker command line. Unit 42, RGDoor.

C04 — TA453 podcast lure. Proofpoint reports a July 2024 attempt against a prominent Jewish religious figure: a fake podcast invitation progressed to document-sharing links and an attempted ZIP/LNK delivery chain involving BlackSmith and the PowerShell backdoor AnvilEcho. Treat this as the report's observed and analyzed delivery chain; it does not establish successful end-to-end compromise of that recipient. Proofpoint, 2024.

Procedure review and defensive use​

The identifier/name checks below use Enterprise ATT&CK 19.1, pinned by the SHA-256 in the repository's data/editorial-attack-19.1.json. A valid identifier alone does not validate a procedure. These mappings are editorial interpretations of the cited behavior, separate from MITRE's own group-to-technique relationships.

ClaimProcedure evidenceReviewed mapping and rationaleBoundary
C03Native module loaded into IIS; Unit 42 report aboveT1505.004 — IIS Components: the persistent component is an IIS moduleDoes not make every webshell an IIS component; TwoFace remains a separate component
C04Malicious delivery links in the reported lure; Proofpoint report aboveT1566.002 — Spearphishing Link: the link is part of targeted phishing deliveryAn opened link alone does not prove execution
C04AnvilEcho analyzed as PowerShell; Proofpoint report aboveT1059.001 — PowerShell: identifies the reported interpreterDoes not imply T1059.003 — Windows Command Shell or successful execution on the recipient

I01 — Defensive inference, not a validated rule. Review changes to IIS module registration against an approved baseline. Unit 42's test found Cookie visibility dependent on logging configuration; assess the privacy and retention consequences before collecting those fields. Correlate available evidence rather than treating a module name as attribution. Unit 42.

I02 — Defensive inference, not measured coverage. For a link-to-script hypothesis, first confirm that mail, download, and process records can be joined in the authorized test environment. Missing telemetry is a visibility gap. An isolated PowerShell event does not identify TA453. Exercise the evidence boundary with the site's benign event validation example; it tests a different, deliberately narrow synthetic rule.

Limitations and conclusion​

This core supports two bounded examples and three procedure interpretations. It does not independently reproduce vendor malware analysis, validate all historical aliases, confirm current targeting, or establish production detection performance. No malware was downloaded or executed for this review. Operational decisions require corroboration from the relevant environment.

The original authored file, deep-research-report (1).md, contains numbered citation artifacts and no source URLs. The import history does not recover their document mapping. The 171 existing unverified-source occurrences remain in the appendix; they are occurrences, not distinct facts. Their numbers have not been reassigned to the sources above.

2026-09-09 source-recovery record: added independently cited C01–C04 and explicitly analytical I01–I02; reviewed three procedure mappings; preserved the earlier taxonomy correction history, including the withdrawal of the email-exfiltration/T1132.001 mapping. Original sponsor assertions, alias equivalences, campaign details, IOC values, and detection claims remain unresolved wherever the appendix carries an unverified-source label. This is a scoped source review, not a complete editorial-review date for the intake.

Core source register​

  • MITRE, OilRig (G0049) and Magic Hound (G0059), live group records accessed 2026-09-09; associated names are framework context. Links are attached to C01. Technique names/IDs are checked separately against the repository's hashed Enterprise ATT&CK 19.1 manifest.
  • Robert Falcone, Palo Alto Networks Unit 42, OilRig uses RGDoor IIS Backdoor on Targets in the Middle East, 2018-01-25, accessed 2026-09-09. Supports C03 and provides the observation underlying I01; the latter remains an inference.
  • Joshua Miller, Georgi Mladenov, Andrew Northern, Greg Lesnewich, and the Proofpoint Threat Research Team, The Best Laid Plans: TA453 Targets Religious Figure with Fake Podcast Invite Delivering New BlackSmith Malware Toolset, 2024-08-20, accessed 2026-09-09. Supports C02 and C04. Links are attached to those claims.

Unresolved intake appendix​

Preserved research intake — not operational evidence

Everything below this notice, through the original correction history, is the preserved intake. Original confidence labels are unverified author judgments. Existing section anchors and source-marker provenance remain available. The sourced core above does not validate these fragments.

OilRig (APT34 / Helix Kitten / Earth Simnavaz etc)​

Executive Summary: OilRig (MITRE APT34) is an Iranian state-sponsored cyber-espionage group known for sophisticated, long-running campaigns against Middle Eastern targets (energy, government, telecom) [unverified source 6, line 148-line 157] [unverified source 13, line 25-line 33]. Recent reports (2023–25) show OilRig persisting against Israeli sectors (defense, telecoms, energy, government), deploying new cloud-powered downloaders (ODAgent, OilCheck, OilBooster, SampleCheck5000 v2/3) that use Microsoft 365 APIs (OneDrive, Outlook, EWS) for stealthy C2 [unverified source 6, line 100-line 108] [unverified source 61, line 949-line 953]. They maintain access via webshells (e.g. ExchangeLeech, RGDoor) and custom backdoors (Solar, Mango, Tonedeaf, Helminth, Karkoff, etc) [unverified source 6, line 94-line 99] [unverified source 50, line 69-line 77]. DNS tunnelling is a signature OilRig technique (e.g. Saitama) for data exfiltration [unverified source 17, line 162-line 170] [unverified source 52, line 130-line 138]. Public reports firmly attribute OilRig to Iran’s intelligence services (MOIS/IRGC) [unverified source 46, line 7-line 14] [unverified source 6, line 148-line 157]. For Israeli defenders, key detection priorities include unusual cloud/API usage, suspicious DNS patterns, and known OilRig loader signatures.

Actor Identity: OilRig (MC–APT34) is tracked under many names. Vendors often equate OilRig with APT34 and Helix Kitten (FireEye) and note aliases like Greenbug, Lyceum, Hazel Sandstorm, Earth Simnavaz, Crambus, and COBALT GYPSY [unverified source 6, line 148-line 157] [unverified source 46, line 7-line 14]. For example, Symantec/Broadcom’s Oct 2023 report labeled a new campaign “Crambus (aka OilRig, APT34)” [unverified source 13, line 25-line 33], and MITRE/Picus lists Hazel Sandstorm and Earth Simnavaz as synonyms of APT34 [unverified source 46, line 7-line 14]. However, not all sources align: Microsoft used “Hazel Sandstorm” to name the actors behind a 2022 Albanian wiper attack (tied to Iran) [unverified source 9, line 62-line 69], whereas other analysts fold Hazel Sandstorm into APT34. In practice, APT34/OilRig appears as one broad Iranian espionage cluster, but analysts should note these vendor-specific naming quirks (e.g. Hazel Sandstorm, Crambus). We treat all these as OilRig references, citing source context when needed (e.g. Symantec explicitly equates “Crambus” with OilRig [unverified source 13, line 25-line 33]).

Sponsor and Command: All sources agree OilRig is Iran-affiliated. Picus Security (Apr 2026) explicitly lists “Attributed To: MOIS” (Iran’s Ministry of Intelligence) for APT34/OilRig [unverified source 46, line 7-line 14]. ESET likewise notes OilRig is “commonly believed to be based in Iran” [unverified source 6, line 148-line 157]. Symantec and others call it an “Iranian … espionage group” [unverified source 13, line 25-line 33]. We find no public evidence of non-state or proxy status for OilRig; it operates as an Iranian state cyber unit. In summary, OilRig is an Iranian state-sponsored actor (IRGC/MOIS).

Israel-Relevant Activity: Multiple sources confirm OilRig/Crambus operations involving Israeli-linked targets. Symantec (Oct 2023) lists “Israel” among the countries targeted by Crambus campaigns [unverified source 13, line 43-line 46]. An ESET report (Dec 2023) explicitly documents a cluster of OilRig attacks hitting only Israeli organizations (healthcare, manufacturing, local government) in 2021–22 [unverified source 6, line 139-line 142]. A 2025 analysis by Brandefense also notes a 2024 campaign “targeting Israeli and Emirati defense companies” via compromised Microsoft 365 accounts [unverified source 48, line 159-line 164]. Collectively, these high-confidence (source-reported) accounts indicate OilRig is actively spying on Israeli government, defense, energy, telecom and municipal entities. Confirmed incidents include phishing-driven intrusions of Exchange/email servers in regional governments (e.g. UAE) [unverified source 21, line 177-line 185], and database breaches in Israeli industry. We mark confidence high (A/B sources) that Israel-related sectors are OilRig targets; gaps remain in public detail of specific victim names or incident timelines.

Intrusion Lifecycle (oilrig): Public reports outline a multi-stage OilRig intrusion chain:

  • Initial Access: Typically spearphishing emails with malicious Office attachments (Word/Excel) or exploitation of exposed services. For example, ESET reported OilRig campaigns delivering macro-based Excel payloads in Israeli targets, though specifics of the lure are not public [unverified source 17, line 162-line 170]. Symantec mentions Crambus using phishing to install PowerShell backdoors (PowerExchange) on Exchange servers [unverified source 13, line 25-line 33]. (Definitive vectors remain mostly “Gap” in sources.)
  • Execution: Victims run downloaded payloads or macros that launch custom tools. The 2022 Jordan case had an Excel macro installer spawning a new backdoor (Saitama) [unverified source 17, line 162-line 170]; CheckPoint observed APT34 macros issuing DNS queries to a public tunnel (requestbin.net) [unverified source 52, line 130-line 138]. ESET notes OilRig’s new C# downloaders (SC5k, ODAgent, etc.) execute via standard Windows process (cmd.exe or PowerShell) [unverified source 61, line 1047-line 1054].
  • Persistence: OilRig implants persist via lightweight backdoors and webshells. Researchers have identified many implants (Tonedeaf, Helminth, Karkoff, Solar, Mango, etc.) used for long-term control [unverified source 48, line 122-line 130] [unverified source 6, line 94-line 99]. In the UAE case, OilRig planted an Exchange webshell (“ExchangeLeech”) on OWA [unverified source 21, line 177-line 185], and Unit42 previously documented an IIS module backdoor (RGDoor) used as a secondary webshell [unverified source 50, line 69-line 77].
  • Privilege Access: OilRig steals and reuses credentials. Brandefense notes credential-dumping tools in OilRig’s arsenal (PoisonFrog, BONDUPDATER) [unverified source 48, line 123-line 130]. Polyswarm observed APT35 (related actor) using Mimikatz and host-scanning, and OilRig is known to collect network accounts once in. In reported cases, compromised service accounts (for Exchange/Cloud) were misused for lateral moves [unverified source 21, line 177-line 185].
  • Defense Evasion: The group blends C2 into normal network/cloud traffic. ESET emphasizes their use of legitimate cloud services (Azure OneDrive, Outlook APIs) for C2 [unverified source 6, line 100-line 108], and encrypted channels. They also obfuscate binaries (string-stacking, XOR encryption) [unverified source 61, line 1061-line 1068] and register payloads with innocuous process names.
  • Discovery: OilRig conducts basic recon (system/domain info). ESET notes their downloaders gather computer name and user name [unverified source 59, line 1138-line 1146], and possibly extract Active Directory info via malicious scripts or webshell commands (Unreported in sources).
  • Lateral Movement: They use RDP and tunneling tools (e.g. Plink) to hop networks. Symantec reports Crambus deployed Plink to forward RDP ports on compromised hosts [unverified source 13, line 35-line 39]. Polyswarm (APT35) listed RDP tunneling (FRP/Plink) in related campaigns [unverified source 30, line 65-line 69], suggesting OilRig may use similar methods.
  • Command & Control: OilRig’s hallmark is multiple C2 channels. Email C2: PowerExchange backdoor on Exchange polls attacker-controlled email for commands [unverified source 13, line 25-line 33]. Cloud API: New downloaders reach out to OneDrive/Outlook accounts for commands and exfil [unverified source 6, line 100-line 108]. DNS Tunnelling: Signature C2 using DNS (Saitama) to carry data [unverified source 17, line 162-line 170] [unverified source 52, line 130-line 138]. Webshells: RGDoor and others listen on HTTP posts (RGDoor uses special Cookie fields) [unverified source 50, line 69-line 77].
  • Exfiltration: Data is exfiltrated via the same channels: files uploaded to cloud storage (OneDrive, Exchange drafts) [unverified source 59, line 1179-line 1187] [unverified source 61, line 1025-line 1032], or encoded in DNS responses [unverified source 17, line 162-line 170]. ESET notes staged files are zipped and sent through C2 [unverified source 59, line 1125-line 1134].
  • Impact: Observed impacts are espionage-level. Symantec linked OilRig to an Albanian government wiper incident in 2022 [unverified source 13, line 25-line 33], but details are unclear (and may involve related IRGC actors). Otherwise, OilRig intrusions yield credential/data theft with minimal destruction. Brandefense explicitly states “destruction is rare” for OilRig [unverified source 48, line 132-line 139]. The main impact is sustained data breach and loss of secrets, rather than overt sabotage.

ATT&CK Mapping (summary): Key techniques include spearphishing (T1566) for initial access, execution via Office macros/PowerShell (T1204, T1059), credential dumping (T1003) and reuse, custom backdoor implants (T1059.003 for Command Shell), webshell deployment (T1505.003; exact procedure requires review) and IIS module persistence (T1505.004 for RGDoor), and use of SaaS C2 (T1567.002, T1102.002) and DNS exfiltration (T1572). Detection should focus on techniques like Office 365 abuse (T1567), DNS tunneling (T1572/T1008), Exchange-based exfiltration (T1567.001), and code obfuscation (T1140/T1070) [unverified source 59, line 1131-line 1140] [unverified source 59, line 1152-line 1161]. Review boundary: Apart from the explicit corrections below, this imported summary has not passed semantic mapping review. IDs for browser cookies, AMSI bypass, cloud C2/exfiltration, backdoor execution, and obfuscation may conflate distinct behaviors; do not export this summary as validated ATT&CK coverage.

Technique IDNameTacticObservableSource / EvidenceMapping Quality
T1566.001Spearphishing AttachmentInitial AccessEmail with malicious Office docsESET [unverified source 17, line 162-line 170], Obsidian [unverified source 21, line 177-line 185]M1 (direct)
T1059.001 / T1059.003PowerShell / Windows Command ShellExecutionThese are distinct interpreters. The imported .ps1 / cmd.exe /c account requires procedure review.MITRE PowerShell and Windows Command Shell establish taxonomy only.Unverified actor mapping
Unassigned pending procedure reviewClaimed outbound email with attachmentsUnconfirmedEmail traffic alone does not establish an exfiltration technique.Original numbered source 13 is unresolved. T1132.001 means Standard Encoding, not email exfiltration.Review required
T1572Protocol Tunneling (DNS)C2Unusual DNS TXT queriesMalwarebytes (Saitama) [unverified source 17, line 162-line 170], CheckPoint [unverified source 52, line 130-line 138]M1
T1102.002Web Service: Exchange Web ServicesC2Persistent SOAP/REST calls to ExchangeObsidian (EWS API) [unverified source 21, line 183-line 192]M1
T1567.002Web Service: OneDrive/GraphC2/ExfiltrationTraffic to OneDrive/Graph API endpointsESET [unverified source 6, line 100-line 108] [unverified source 59, line 1179-line 1187]M1
T1505.004IIS ComponentsPersistenceRGDoor establishes persistence as an IIS module.MITRE RGDoor procedure and MITRE T1505.004 explicitly document this mapping. ExchangeLeech is a separate unresolved procedure.Taxonomy and RGDoor procedure checked
T1070.004Indicator Removal: File DeletionDefense EvasionSuspicious process deleting filesESET (downloader deletes local) [unverified source 61, line 1081-line 1088]M2
T1036.005Masquerade: Path/NameDefense EvasionExecutables with legitimate-looking namesESET (OilBooster), Polyswarm (various) [unverified source 61, line 1096-line 1104]M3

(Mapping quality M1=direct evidence in sources; M2=plausible given context; M3=inferred.)

Associated Tools: OilRig employs many custom and public tools. Noteworthy examples (with published references):

  • ODAgent (downloader): A C#/.NET downloader that uses Microsoft OneDrive API for C2. ESET confirmed it in 2022 Israeli campaigns [unverified source 6, line 100-line 108]. Sample name ODAgent.exe; SHA1 7E498B3366F54E936CB0AF767BFC3D1F92D80687 (ESET) [unverified source 61, line 951-line 954]. Detection: monitor OneDrive API usage and look for this filename/hash.
  • OilCheck (downloader): C# downloader using Outlook/Exchange accounts for commands. Seen as AppLoader.exe and CheckUpdate.exe [unverified source 61, line 949-line 953]. Example hashes: 8D84D32DF5768B0D4D2AB8B1327C43F17F182001 (AppLoader) [unverified source 61, line 949-line 953].
  • OilBooster (downloader): 64-bit C# downloader using OneDrive. Identified as consoleapp.exe (Win64/OilBooster.A) [unverified source 61, line 938-line 940]; SHA1 1B2FEDD5F2A37A0152231AE4099A13C8D4B73C9E.
  • SampleCheck5000 (SC5k) downloader: Legacy downloader with multiple versions (v1–v3) using email APIs. ESET lists SC5k hashes (various) [unverified source 61, line 930-line 938].
  • Solar (backdoor): A C# implant used for command execution, mentioned by ESET as a “major tool” [unverified source 6, line 94-line 99]. (Public IOCs not listed.)
  • Mango (backdoor): Another C# implant (multi-threaded backdoor) used by OilRig [unverified source 6, line 94-line 99].
  • Tonedeaf / Helminth / Karkoff (implants): Lightweight backdoors (HTTP/PowerShell) known from older campaigns [unverified source 48, line 122-line 130].
  • PoisonFrog / BONDUPDATER (credential tools): PowerShell-based tools for stealing credentials, mentioned by Brandefense [unverified source 48, line 123-line 130].
  • PowerExchange (Exchange backdoor): A custom PowerShell backdoor that logs into an Exchange server, reads attacker-sent emails for commands, and replies via email. Documented by Symantec [unverified source 13, line 25-line 33].
  • ExchangeLeech (webshell): An ASP.NET shell deployed on OWA (Exchange) in 2023, used to facilitate Exchange C2 [unverified source 21, line 177-line 185].
  • RGDoor (IIS backdoor): A C++ DLL loaded as an IIS module. Unit42 found it on Middle Eastern gov web servers as a stealth backdoor [unverified source 50, line 69-line 77].
  • ZeroCleare (OT wiper): An industrial control system wiper attributed to Iranian actors. Its linkage to OilRig is speculative; most sources treat it separately. We mark it “Gap” and do not attribute OilRig directly to ZeroCleare operations.

Public IOCs: Only source-published indicators are listed. For OilRig, ESET’s report provides hashes for its downloaders (as above) [unverified source 61, line 949-line 954]. A fallback C2 domain was “host1[.]com” (188.114.96[.]2) [unverified source 61, line 969-line 978]. For Magic Hound (see below) Proofpoint published SHA256s of the phishing artifacts and C2 domains [unverified source 74, line 789-line 797] [unverified source 75, line 579-line 588]. Other notable IOCs: understandingthewar[.]org (lure domain for TA453 [unverified source 74, line 839-line 847]) and deepspaceocean[.]info (C2 for APT35) [unverified source 75, line 579-line 588].

Detection & Hunting (OilRig-specific): Key hypotheses for defenders:

  • Cloud/API Abuse: Monitor Azure/Office365 telemetry for anomalous Graph, OneDrive or EWS activity from unusual users or hosts (T1102/T1567). OilRig downloaders repeatedly fetch payloads via a shared OneDrive/Outlook account [unverified source 6, line 100-line 108]. Telemetry: Office logs (Graph API calls, EWS mailbox access). Lookback: 90d. False Positives: File sync by legitimate cloud services. Escalation: Alert on single account accessed by multiple IPs or machines, or large data pull.
  • DNS Tunneling: Search DNS logs for abnormal TXT/AAAA queries or high-volume queries to suspicious domains. OilRig’s Saitama and SideTwist tools beacon via DNS [unverified source 17, line 162-line 170] [unverified source 52, line 130-line 138]. Telemetry: DNS server logs. False Positives: DNSBL services, CDNs. Escalation: Long or non-website DNS payloads.
  • Email Backdoor Activity: Detect unusual activity on on-prem Exchange servers (T1132) such as sending drafts or replying to auto-forwarding addresses. The PowerExchange backdoor monitors special sender addresses [unverified source 13, line 25-line 33]. Telemetry: Exchange admin logs, email journaling. False Positives: Automated alerts. Escalation: Emails sent during off-hours or from service accounts to external domains.
  • Webshell Indicators: Hunt for IIS/Exchange webshell artifacts. E.g. RGDoor looks for a cookie “RGSESSIONID” in POST data [unverified source 50, line 69-line 77], and ExchangeLeech hides as a static ASPX page. Telemetry: IIS logs (unusual POSTs with long cookies), file integrity checks on web directories. Escalation: Detection of known webshell names or patterns triggers incident review.
  • Process/Endpoint: Watch for known OilRig binary names or hashes (ODAgent.exe, OilBooster consoleapp.exe, etc [unverified source 61, line 949-line 953]). Also monitor for hidden PowerShell windows or unusual cmd.exe use by system accounts (OilBooster hides its console [unverified source 61, line 1075-line 1084]). Telemetry: Endpoint logs, Sysmon. Escalation: Creation of these processes on workstations or servers.
  • General Reconnaissance: Unusual use of network discovery tools or Kerberoasting (mentioned by Picus [unverified source 46, line 49-line 58]). Telemetry: Active Directory and network logs. Lookback: Seasonal (past 30d). Escalation: Domain-wide credential spraying or AS-REP Roasting attempts.

Source Register (OilRig): Key sources for OilRig (2023–2026):

  • Broadcom/Symantec Threat Intelligence (Oct 2023) – “Crambus” blog by A. Malik. Reliability: A (vendor report) [unverified source 13, line 25-line 33].
  • ESET Research blog (Dec 2023) – “OilRig’s persistent attacks…” by D. Antoniuk. Reliability: A [unverified source 6, line 148-line 157] [unverified source 6, line 100-line 108].
  • Malwarebytes ThreatIntel (May 2022) – “APT34 targets Jordan… Saitama” by M. Cenciotti. Reliability: A [unverified source 17, line 162-line 170].
  • Obsidian Security blog (May 2023) – “APT34 Earth Simnavaz targets Exchange” by S. Zhu. Reliability: B [unverified source 21, line 177-line 185].
  • Picus “Iranian Threat Actors” (Apr 2026). Reliability: B [unverified source 46, line 7-line 14].
  • Brandefense analysis (Dec 2025) – “OilRig profile”. Reliability: C [unverified source 48, line 123-line 130] [unverified source 48, line 159-line 164].
  • (Others: NJCCIC, Unit42 for RGDoor (2018), etc., for background context; not all cited here.)

Evidence Register (OilRig): Notable evidence points:

  • Alias Mapping: Symantec directly states “Crambus espionage group (aka OilRig, APT34)” [unverified source 13, line 25-line 33] (source-reported, high confidence). Picus likewise lists Hazel Sandstorm and others under APT34 [unverified source 46, line 7-line 14]. We tag these as source-reported alias claims (Reliability A/B).
  • Attribution: ESET’s phrasing “commonly believed to be based in Iran” [unverified source 6, line 148-line 157] and Picus’s “Attributed to MOIS” [unverified source 46, line 7-line 14] are source-reported state links (Reliability A/B). No contradictory attribution is found.
  • Campaigns/Targets: ESET’s Israel-targeting description [unverified source 6, line 139-line 142] and Symantec listing Israel as affected [unverified source 13, line 43-line 46] are source-reported facts (A). No inconsistencies on victimology have been cited.
  • Gaps: Initial access methods in recent campaigns are not described (we mark as Gap); similarly, any direct proof linking OilRig to ZeroCleare is absent, so treat that as Gap.

Tool Intelligence (OilRig): Key tools and references (for intelligence database):

Tool NameTypeActor ConfidenceBehavior / NotesKnown IOCs (from sources)Source
ODAgentDownloaderHigh (A)C# downloader using OneDrive API for C2/exfiltrationSHA1: 7E498B33…0687 (ODAgent.exe) [unverified source 61, line 951-line 954]ESET [6][61]
OilCheckDownloaderHigh (A).NET downloader using Outlook/Exchange APISHA1: 8D84D32D…2001 (AppLoader.exe); DDF0B7B5…A3CB910 (CheckUpdate.exe) [unverified source 61, line 949-line 953]ESET [61]
OilBoosterDownloaderHigh (A)Win64/.NET downloader using OneDriveSHA1: 1B2FEDD5…B73C9E (consoleapp.exe) [unverified source 61, line 938-line 940]ESET [61]
SC5k v1-3DownloaderHigh (A)Legacy downloader variants (uses Outlook/Exchange for C2)Various SHA1s (SC5k v1/v2/v3 shown in [61])ESET [61]
SolarBackdoor (C#)High (A)Multi-threaded C# backdoor implant–ESET [6]
MangoBackdoor (C#)High (A)C# backdoor used by OilRig–ESET [6]
PowerExchangeBackdoorHigh (A)PowerShell Exchange backdoor: reads attacker emails for commands–Symantec [13]
ExchangeLeechWebshellHigh (A)ASPX webshell on Exchange OWA–Obsidian [21]
RGDoorWebshell (DLL)High (A)IIS module backdoor listening on HTTP POST–Unit42 (2018)
TonedeafBackdoorMedium (B)HTTP backdoor (custom)–Brandefense [48]
HelminthBackdoorMedium (B)PowerShell backdoor–Brandefense [48]
KarkoffBackdoorMedium (B)Native backdoor–Brandefense [48]
PoisonFrogCredential stealMedium (B)PowerShell credential stealer–Brandefense [48]
BONDUPDATERCredential stealMedium (B)PowerShell credential stealer–Brandefense [48]
ZeroCleareWiper (ICS)Low (F)Industrial wiper; attribution to APT34 unconfirmed–– (Gap)

Navigation/Crosslinks: Link this profile to the MITRE APT34 actor page and “Iranian APT” page. Cross-reference related tools (e.g. ODAgent, OilBooster, RGDoor) on the malware/tool pages. In TTP matrices, highlight the techniques above (cloud C2, DNS exfil, PowerShell). Relevant hunts (DNS tunneling, cloud abuse, Exchange backdoor) should link here. For worked cases, note the 2024 UAE Exchange incident [unverified source 21, line 177-line 185] and ODAgent-related Israeli case [unverified source 6, line 139-line 142].

Gaps & Follow-up: Several gaps remain. Public reports do not detail OilRig’s initial access vectors in 2023–24 (phishing templates, exploit CVEs) – obtaining email/gateway logs would fill this. The connection of destructive malware (e.g. ZeroCleare) to OilRig is not confirmed; we mark this gap and note it would require classified SIGINT or new forensic evidence. IoC coverage is limited to vendor appendices; defenders should seek additional indicators (e.g. domain/IP clusters) from telemetry. Finally, whether “Hazel Sandstorm” denotes a sub-unit or just naming conflict remains ambiguous – further intelligence would clarify this taxonomy.

Magic Hound (APT35 / Charming Kitten / TA453 / Mint Sandstorm)​

Executive Summary: Magic Hound (MITRE G0059; often called APT35/Charming Kitten) is an Iranian cyber-espionage group specializing in human-targeted operations. Recent (2023–26) reporting confirms they pursue Israeli and regionally sensitive targets using elaborate phishing and custom malware. For example, in July–Aug 2024 TA453 (APT35) phished an Israeli religious leader with a fake “podcast invite,” culminating in deployment of a new multi-module PowerShell backdoor (“BlackSmith”/“AnvilEcho”) [unverified source 75, line 490-line 499]. Intelligence reports (Google/Mandiant) now label this cluster APT42 – an IRGC-linked actor overlapping with APT35/Charming Kitten [unverified source 26, line 99-line 108]. Microsoft uses Mint Sandstorm/Phosphorus and Proofpoint uses TA453. We adopt “Magic Hound” (MITRE) as the umbrella name, noting vendor differences. Key recent TTPs include sophisticated social engineering (spoofed personas, DocSend links, ISW impersonation [unverified source 75, line 507-line 515]), PowerShell loaders (DownPaper, CharmPower) and RATs (Pupy). Hunters should monitor mail flows and cloud logs for credential theft patterns and known Charming Kitten artifacts.

Actor Identity: The group is tracked under multiple names. Microsoft’s Mint Sandstorm (aka Phosphorus) corresponds to this cluster, Google’s APT42 significantly overlaps (and they explicitly equate it with Charming Kitten, TA453) [unverified source 26, line 99-line 108], and others use TA453 or Cobalt Illusion. Mandiant/Google says “APT42 activities overlap with … Charming Kitten … Mint Sandstorm (Microsoft) [and] TA453 (Proofpoint)” [unverified source 26, line 99-line 108]. Microsoft likewise states that its Mint Sandstorm tracking overlaps with APT35 and TA453 [unverified source 28, line 106-line 112]. Thus, APT35, APT42, Charming Kitten, TA453, Mint Sandstorm etc. all refer to a single IRGC-led actor, but analysts should apply vendor caveats (e.g. MS uses Mint Sandstorm, Google uses APT42). Our write-up treats them as one cluster, citing source-specific names.

Sponsor and Command: Public sources tie Magic Hound to Iran’s IRGC. Google/Mandiant describes APT42 as “Iranian state-sponsored (IRGC-IO)” [unverified source 26, line 99-line 108]. Microsoft explicitly links Mint Sandstorm to Iran’s Revolutionary Guard intelligence [unverified source 28, line 106-line 112], noting U.S. sanctions on it. No source suggests a non-Iranian patron. The group is widely assessed as an IRGC intelligence unit (often called “Unit 418/47” or “Unit 50”).

Israeli Relevance: There is high-confidence evidence of Magic Hound targeting Israeli interests. Proofpoint’s Aug 2024 report details a TA453 (APT35) operation explicitly against an Israeli religious official via a fake “ISW podcast” invite [unverified source 75, line 507-line 515]. In that case, two of the target’s email accounts (work and personal) were phished, indicating a tailored Israeli victim focus. Open-source analysis also notes increased APT35 targeting of Israel after the Oct 2023 war – for instance, one security blog observed attacks on Israeli think-tanks and decision-makers post-Nov 2023 [unverified source 39, line 173-line 182]. Microsoft’s coverage of Mint Sandstorm also highlights attacks on Middle Eastern and Western targets including Israeli government-related organizations. In sum, Magic Hound frequently includes Israel in its target set (government, academia, civil society, tech sectors). We rate this as source-reported and assessed (from Proofpoint and other tracking); gaps include lack of public detail on other specific Israeli victims or incidents.

Intrusion Lifecycle (Magic Hound): Recent case studies illustrate the attack chain:

  • Initial Access: Primarily through targeted spear-phishing with social engineering. In the 2024 case, the adversary contacted an Israeli target under the guise of a research institute director and eventually sent a malicious DocSend link [unverified source 75, line 507-line 515]. Earlier, Charming Kitten has used credential-harvesting pages and exploitable web apps. Some reports (e.g. DomainTools leaked docs) imply they also exploit Exchange (ProxyLogon/EWS) and VPN flaws, but concrete 2023 examples are scant.
  • Execution: The malware is delivered via scripts. In the Proofpoint case, a GoogleDrive link led to a ZIP containing a LNK shortcut which executed the “BlackSmith” toolset (PowerShell-based) [unverified source 75, line 539-line 547]. Other campaigns use malicious documents or LNK loaders. The final payload “AnvilEcho” is a PowerShell backdoor.
  • Persistence: The BlackSmith toolkit uses multiple DLLs: an installer (soshi.dll) that copies files and registers a service (toni.dll) [unverified source 75, line 579-line 588]; the final stage (AnvilEcho) persists as a scheduled job or service. Proofpoint notes the malware creates a service entry and bypasses AV (AMSII) by patching memory [unverified source 75, line 581-line 589] [unverified source 75, line 590-line 598].
  • Privilege Escalation: Post-compromise, Magic Hound harvests credentials (browser cookies, local files). Earlier TA453 modules included a PowerLess stealer (cookies) [unverified source 75, line 551-line 560]. They also employ Plink/FRP to access other machines (Polyswarm observed Plink usage) [unverified source 30, line 65-line 69]. Credential reuse (found in DomainTools data) suggests they leverage domain trust to escalate privileges.
  • Defense Evasion: The toolkit heavily obfuscates scripts and binaries. In BlackSmith, payloads are encrypted (AES/ECB) and hidden (steganography in images) [unverified source 75, line 581-line 589] [unverified source 75, line 590-line 598]. AMSI and ETW are bypassed by patching (ton.dll does this) [unverified source 75, line 590-line 599]. Each component blends into system processes, and communication is encrypted (Proofpoint notes custom encryption routines).
  • Discovery: The malware gathers extensive system info. The DomainTools leak indicates APT35 exporting Global Address Lists (GALs) from Exchange servers for reconnaissance (implying GAL harvest) [unverified source 34, line 19-line 28]. In BlackSmith, modules check installed AV and machine ID (unique fingerprint) [unverified source 75, line 590-line 599].
  • Lateral Movement: Tools like Plink/RDP tunnels, as well as internal phishing, are used to spread. APT35 has been observed using compromised credentials to roam (no single 2023 example cited, but consistent with past operations).
  • Command & Control: Persistent C2 channels are used. BlackSmith’s AnvilEcho connects to deepspaceocean[.]info [unverified source 75, line 611-line 614]; if that fails, it fetches payloads from d75[.]site (both are APT35-controlled). Communication uses HTTPS with custom encryption [unverified source 75, line 581-line 589] [unverified source 75, line 611-line 619].
  • Exfiltration: Data (documents, credentials) are exfiltrated through the same channels or via email/HTTP POST backdoors. The BlackSmith suite includes a browser cookie stealer (PowerLess) reported by Volexity and included in the final toolset [unverified source 75, line 570-line 578]. Proofpoint says the malware is “designed to enable intelligence gathering and exfiltration” [unverified source 75, line 498-line 504].
  • Impact: Magic Hound’s impact is data theft and espionage. No publicly known destructive attacks are linked directly to APT35/Magic Hound. The focus is on pilfering sensitive info from targeted individuals and networks. (Note: any reports of Iranian wipers or saboteurs should not be attributed to Magic Hound without clear evidence.)

ATT&CK Mapping (summary): Key techniques include spearphishing (T1566), use of living-off-the-land and scripting interpreters (T1059.001 for PowerShell (taxonomy correction; actor procedure requires review)), credential dumping (T1003), use of remote services (T1567/T1102 via cloud/staging domains), browser cookie stealing (T1555.003), and disabling defenses (T1562.009 for AMSI bypass). Recorded use of specific malware (PowerLess stealer, AnvilEcho) aligns with Threat Intel techniques. (See published matrices for TA453/Charming Kitten for more.) Review boundary: Apart from the explicit corrections below, this imported summary has not passed semantic mapping review. IDs for browser cookies, AMSI bypass, cloud C2/exfiltration, backdoor execution, and obfuscation may conflate distinct behaviors; do not export this summary as validated ATT&CK coverage.

Associated Tools: Known Magic Hound/Charming Kitten tools include:

  • CharmPower: A PowerShell backdoor/loader. (Mentioned in Polyswarm’s listing of TA453 tools [unverified source 71, line 1-line 4].)

  • DownPaper: A PowerShell script dropper. (Polyswarm [unverified source 71, line 1-line 4].)

  • PowerLess: Browser credential stealer (cookies) – earlier TA453 tool (Proofpoint notes its capabilities in BlackSmith [unverified source 75, line 531-line 539]).

  • Sponsor: A C# Exchange webshell, first seen in 2021 (Polyswarm noted its reuse by Charming Kitten [unverified source 30, line 49-line 58]).

  • Pupy: An open-source Python RAT known to be used by Charming Kitten in the past [unverified source 30, line 80-line 87].

  • BlackSmith/AnvilEcho: The new 2024 toolkit – a multi-stage implant in C++ and PowerShell as detailed by Proofpoint [unverified source 75, line 498-line 507] [unverified source 75, line 579-line 588].

  • FRP/Plink: RDP tunneling tools observed in their infrastructure (Polyswarm and others list Plink) [unverified source 30, line 65-line 69].

  • Mimikatz, GOST, etc.: Public tools used opportunistically (Polyswarm lists Mimikatz, GOST among others).

    (Where available, we have cited vendor reports. Public hashes for these tools are rare; we rely on source appendices where provided.)

Public IOCs: From Magic Hound reports: Proofpoint published SHA256 hashes of lure files and binaries from the TA453 2024 incident [unverified source 74, line 789-line 797]. For example, the .LNK dropper had SHA256 5dca88f08b586a51677ff6d900234a1568f4474bbbfef258d59d73ca4532dcaf [unverified source 74, line 789-line 797]. Domains include understandingthewar[.]org (phishing site) [unverified source 74, line 839-line 847], d75[.]site (stager/C2) [unverified source 74, line 839-line 847], and deepspaceocean[.]info (C2) [unverified source 75, line 579-line 588]. We do not list user credentials or purely internal artifact names. All listed IOCs come from cited sources.

Detection & Hunting (Magic Hound-specific): Key hypotheses for defenders:

  • Targeted Phishing Campaigns: Monitor email traffic for common Charming Kitten lures. E.g., unusual inbound from newly-registered domains (e.g. ISW spoof, DocSend) to high-profile staff. Proofpoint’s case started with messages from understandingthewar[.]org [unverified source 75, line 531-line 539] [unverified source 74, line 839-line 847]. Telemetry: Secure Email Gateway logs, link scanner logs. Lookback: 90d. Behavior: Lures referencing embassies, think tanks. False Positives: Legit invites. Escalation: Review if several internal users get similar high-level invites.
  • Credential Harvesting Detection: TA453 often seeks SMTP/Exchange credentials. Check for anomalous sign-ons or EWS connections. DomainTools leak implies bulk GAL exports (e.g. Get-GlobalAddressList) [unverified source 34, line 19-line 28]. Telemetry: Exchange OWA/EWS logs, Azure AD logs. Observable: export of address lists, repeated mailbox login failures/success from unexpected IP. Escalation: Mass mailbox exports or logins from TOR/VPNs.
  • Endpoint Malware: Hunt for known Charming Kitten filenames or hashes (e.g. AnvilEcho scripts, PLINK.exe usage, mary.dll, soshi.dll, toni.dll from Proofpoint) [unverified source 74, line 789-line 797] [unverified source 75, line 579-line 588]. Telemetry: Antivirus/EDR logs, Sysmon. Lookback: 30d. False Positives: Legitimate security tools or VR-ready software. Escalation: Any process named PLINK.exe or unexpected service registration (tonii.dll) on workstations.
  • FRP/RDP Tunneling: Monitor for RDP port-forwards or unusual RDP session chains. Plink usage may appear as plink.exe or via event logs (Event ID 4624 with odd source). Telemetry: Windows event logs, firewall/NDR. Escalation: Unexplained RDP server exposures.
  • Cloud Account Hijack: APT35 often uses legitimate cloud apps (DocSend, Google Drive). Look for new OAuth app consents or API connections to Google/OneDrive by accounts, especially from unusual geos. Telemetry: Cloud audit logs. Escalation: Novel OAuth consents or service principals not set by admins.
  • PowerShell Activity: Since BlackSmith/AnvilEcho is PowerShell-based, detect its execution patterns (extensive Base64 decoding, etc.). Proofpoint notes the PS loads (e.g. videogui.exe and regsvr32 staging) [unverified source 75, line 569-line 579]. Telemetry: PowerShell logs (Module Logging, ScriptBlock). False Positives: Admin scripts. Escalation: Base64 heavy scripts with I/O to suspicious domains.
  • Browser/Stealer Artifacts: Because APT35 steals browser cookies, hunt for anomalous telemetry suggesting new XMRig or stealers (though stealthy). Not specific here.

Source Register (Magic Hound): Key sources on APT35/TA453 (2023–2026):

  • Proofpoint threat blog (Aug 2024) – “Best Laid Plans: TA453…” by J. Miller et al. Reliability: A [unverified source 75, line 490-line 499] [unverified source 75, line 579-line 588].
  • Google Cloud (Mandiant) blog (May 2024) – “Untangling APT42” by G. Kasperavicius et al. Reliability: A [unverified source 26, line 99-line 108].
  • Microsoft Security Insider (Apr 2023) – “Nation-state Mint Sandstorm…” by W. Grimes et al. Reliability: A [unverified source 28, line 106-line 112].
  • Polyswarm blog (Sept 2023) – “Charming Kitten using Sponsor” by S. Johnson. Reliability: C/B [unverified source 30, line 65-line 69] [unverified source 30, line 80-line 87].
  • DomainTools (June 2023) – “APT35 Internal Leak” (analysis by ThreatIntel). Reliability: B (research report).
  • (Optional: Tech blogs like FalconFeeds (Mar 2026) on post-2023 targeting [unverified source 39, line 173-line 182] – used for contextual timing.)

Evidence Register (Magic Hound): For example, Microsoft explicitly notes “Mint Sandstorm… overlaps with … APT35, APT42, Charming Kitten, TA453” [unverified source 28, line 106-line 112] (source-reported). Google/Mandiant similarly links APT42 with Charming Kitten [unverified source 26, line 99-line 108]. Proofpoint’s case study provides direct descriptions of the 2024 attack [unverified source 75, line 507-line 515] (source-reported). We see no conflicting claims on sponsor (all link to IRGC). Gaps include separate handling of APT42 vs APT35 by some intel groups – we flag that as a taxonomy issue rather than evidence conflict.

Tool Intelligence (Magic Hound): Representative tools (source-cited):

Tool NameTypeActor ConfidenceBehaviorNotes / HashesSource
BlackSmithToolkit (PS/RAT)High (A)Multi-stage toolset culminating in PowerShell trojan AnvilEcho–Proofpoint [unverified source 75, line 490-line 499]
AnvilEchoBackdoor (PS)High (A)PowerShell backdoor with encryption, network comms–Proofpoint [unverified source 75, line 490-line 499]
PowerLessCredential StealHigh (A)Steals browser cookies/credentialsMentioned (in AnvilEcho)Proofpoint [unverified source 75, line 549-line 558]
CharmPowerPS BackdoorHigh (A)Code injector/loader–Polyswarm [unverified source 71, line 1-line 4]
DownPaperPS BackdoorHigh (A)Script-based backdoor–Polyswarm [unverified source 71, line 1-line 4]
PupyRAT (Python)High (A)Remote access trojan–Polyswarm [unverified source 71, line 1-line 4]
SponsorBackdoorMedium (B)ASPX Exchange backdoor (reused by APT35)–Polyswarm [unverified source 30, line 49-line 58]
Plink (FRP)Tunneling toolHigh (A)RDP port forwarding–Polyswarm [unverified source 30, line 65-line 69]

Navigation/Crosslinks: Link this profile to the APT35/Magic Hound actor page, the broader “Iranian APT” cluster page, and to tool pages (e.g. “BlackSmith”, “AnvilEcho”, FRP). In TTP matrices, connect to phases (e.g. initial access=phishing, credential access=browser stealers). Crosslink phishing hunts (email source tracking), cloud account hunts, and TA453 publications.

Gaps & Follow-up: Several areas lack detail. Initial Infection Vector: The exact phishing content and exploit chain (e.g. browser vs document, CVEs) for many recent cases is not fully public (Gap). Incident-specific telemetry (e.g. proxy logs) would help. Alias Disambiguation: Some sources still separate APT42 from APT35/TA453; clarity would require additional cross-source reconciliation. IoCs: Only vendor reports provide IOCs; more indicators (e.g. IP blocks, header fingerprints) would aid defenses. We also note that many Charming Kitten tools are open-source or dual-use (e.g. Plink, Pupy) and not definitive attribution on their own. Future intel collection (mail logs, executive orders, high-value target artifacts) is needed to fill these gaps.

Imported source assessment — unverified: The original intake listed vendor and government publishers, but its numbered source-to-document mapping is missing. No claim of complete URL verification or source-backed status is retained. Recover the original research export before relying on this section.

Correction history and evidence boundary​

On 2026-09-09, taxonomy was checked against Enterprise ATT&CK 19.1, using the official versioned STIX bundle. The bundle hash and reviewed mapping manifest are committed under data/editorial-attack-19.1.json.

  • RGDoor: corrected the nonexistent T1505.008 to T1505.004, IIS Components. MITRE's RGDoor record explicitly maps its IIS module persistence. This does not validate the separate ExchangeLeech claim.
  • PowerShell and cmd.exe: separated T1059.001, PowerShell from T1059.003, Windows Command Shell. The report's actor-specific execution claims remain unverified until procedure provenance is recovered.
  • Email exfiltration: withdrew the T1132.001 mapping without assigning a substitute. T1132.001, Standard Encoding does not by itself describe email exfiltration.
  • Raw citation artifacts were converted to explicit unverified-source labels retaining their original numbers and line references. No numbered citation was guessed or represented as a repaired source link.
  • Related summary mappings were flagged for semantic review, including browser cookies versus browser credentials and disabling logging versus AMSI bypass. This is a scoped correction, not a complete expert review of the report or the site.

References​

Follow My Work​

Follow My Work​

1200km research and practical learning · Research RSS · About the author.