Magic Hound
APT35 is an Iranian state-linked threat actor widely tied in the provided content to the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC IO). Known aliases in the content include Magic Hound, Charming Kitten, APT35, Phosphorous/Phosphorus, TA453, TA455, TA456, Mint Sandstorm, Crimson Sandstorm, Smoke Sandstorm, Agent Serpens, Cobalt Mirage, Cobalt Illusion, Imperial Kitten, ITG18, NewsBeef, Newscaster, Parastoo, Tortoiseshell, UNC1549, Nimbus Manticore, Bohrium, Calanque, Cuboid Sandstorm, Curium, DEV-0228, Houseblend, Yellow Liderc, and others. The content describes this actor as active since at least 2014 and engaged in cyber espionage. Reported targeting includes individuals and organizations in academic research, government, human rights groups, media, military, and technology sectors in Iran, the United States, Israel, and the United Kingdom; energy, government, and technology sectors in Saudi Arabia; and, under UNC1549/Nimbus Manticore tracking, aerospace, aviation, and defense organizations across the Middle East, South Asia, and Western Europe. The content also states that TA453 targeted senior medical researchers in the United States and Israel in late 2020, and in 2024 targeted a prominent Jewish religious figure using a fake podcast invitation. Tradecraft directly mentioned in the content includes credential phishing, social engineering, fake recruitment and career portals, spoofed institutional identities, malicious email attachments, and malware delivery through multi-stage payloads. The actor has used HTTP for command and control. ATT&CK-style behavior attributed in the content to Magic Hound/Curium includes luring victims into opening malicious email attachments, exfiltrating data from compromised machines, gathering local IP address, MAC address, external IP address, and victim username, listing logical drives and directory contents, and determining whether newly dropped files should execute in a hidden window. Malware and tooling directly associated in the content include BellaCiao, publicly attributed there to Charming Kitten, and BellaCPP, assessed with medium-to-high confidence as associated with Charming Kitten; Drokbk, operated by a subgroup of Cobalt Mirage; BlackSmith and the AnvilEcho PowerShell trojan used by TA453; and TOTPGuard used in Nimbus Manticore recruitment-themed operations. The content also describes a late-2025 leak of internal APT35 documents that allegedly revealed a hierarchical, quota-driven espionage organization tied to the IRGC IO, with operations from May 2022 through October 2025 including Exchange exploitation and data exfiltration against regional government, diplomatic, judicial, and infrastructure targets.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Commercial & Professional Services
- Military
Where they're from
Attributed origin per open-source reporting.
- IR
Tradecraft
66 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
45 malware families attributed to this actor across reporting.
40 additional families tracked in Mallory.
Associated vulnerabilities
18 CVEs this actor has used in observed campaigns. 18 of them exploited in the wild.
These campaigns leveraged vulnerabilities like ProxyShell to extract Global Address Lists (GALs), providing a systematic feed for further credential harvesting and long-term espionage.
The February intrusion that Secureworks incident responders investigated began with a compromise of a VMware Horizon server using two Log4j vulnerabilities (CVE-2021-44228 and CVE-2021-45046).
Microsoft warns that Iran-linked APT groups have been observed exploiting the CVE-2023-27350 flaw in attacks against PaperCut MF/NG print management servers. The CVE-2023-27350 flaw is a PaperCut MF/NG Improper Access Control Vulnerability. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM.
FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange. ... Magic Hound has exploited ... ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)
APT35 , also known as Magic Hound, has confirmed active exploitation of ... ConnectWise ScreenConnect (CVE-2024-1709)
13 more CVEs tied to this actor tracked in Mallory.
Observables
385 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cyber-espionage operations targeting aerospace, aviation, and defense organizations, using fake React-based career portals to deliver multi-stage payloads and exfiltrating data over encrypted C2 channels.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Conducting a fake recruitment campaign via LinkedIn and a spoofed hiring portal to deliver a multi-stage malware chain against aerospace and defense professionals.
Iranian state-sponsored espionage activity targeting the U.S. aviation industry, software development sector, and regional defense/aerospace organizations using career-themed phishing and, more recently, SEO poisoning to deliver backdoors including MiniFast and MiniJunk.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.