Magic Hound
APT35 is an Iranian state-sponsored threat actor. The provided content links this cluster to aliases including Magic Hound, Charming Kitten, Charming Kitten APT, Phosphorous/Phosphorus, Mint Sandstorm, Crimson Sandstorm, Cuboid Sandstorm, Smoke Sandstorm, Nimbus Manticore, UNC1549, Tortoiseshell, Agent Serpens, CURIUM, TA453, TA455, TA456, ITG18, DEV-0228, Imperial Kitten, NewsBeef, Newscaster, Bohrium, Calanque, Cobalt Illusion, Cobalt Mirage, Houseblend, Parastoo, Yellow Liderc, and others. The content states that Nimbus Manticore/UNC1549/Smoke Sandstorm overlaps with Tortoiseshell and has been publicly linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), and separately describes Nimbus Manticore as an Iran state-sponsored group affiliated with the IRGC. The actor has targeted aerospace, defense, aviation, telecommunications, software, diplomatic, and public-sector victims across the Middle East, Europe, the United States, Saudi Arabia, Australia, Israel, and the United Arab Emirates. Reported operations include fake recruitment and career-themed phishing, including LinkedIn recruiter impersonation and fake hiring portals, as well as spoofed institutional identities and counterfeit documentation. The group has also targeted defense contractors and IT providers and has attempted supply-chain compromise. Tradecraft directly mentioned in the content includes spearphishing with malicious attachments, exploitation of public-facing applications, web-shell deployment, PowerShell-based execution and reconnaissance, AppDomain hijacking, scheduled-task persistence, SEO poisoning, and use of Azure-hosted command-and-control infrastructure. Magic Hound/CURIUM activity includes PowerShell scripts for initial process execution and data gathering, collection of host details such as system architecture, OS version, UUID, host name, and username, exfiltration of data from compromised machines, use of a web shell to exfiltrate a ZIP archive containing an LSASS memory dump, and deletion/overwriting of files to cover tracks. Recent activity in the content attributes 2025-2026 campaigns to Nimbus Manticore/UNC1549, including fake job campaigns against aerospace and defense professionals, trojanized installers delivered through AppDomain hijacking, and deployment of backdoors including MiniJunk and MiniFast. During Operation Epic Fury in 2026, the group targeted the U.S. aviation industry and other sectors, used fake airline job offers and a trojanized Zoom installer, and later used SEO poisoning via a fake Oracle SQL Developer site. MiniFast is described as supporting reconnaissance, command execution, file and folder operations, data exfiltration, payload download, and persistence via scheduled tasks. The content also notes earlier backdoors associated with Nimbus Manticore, including MINIBIKE, TWOSTROKE, and DEEPROOT.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
- Military
Tradecraft
53 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
39 malware families attributed to this actor across reporting.
34 additional families tracked in Mallory.
Associated vulnerabilities
16 CVEs this actor has used in observed campaigns. 16 of them exploited in the wild.
PHOSPHORUS Automates Initial Access Using ProxyShell ... the creation of web shells were observed during the exploitation of internet facing services in PHOSPHORUS Automates Initial Access Using ProxyShell.
The primary vulnerability at the center of the event and this review (CVE-2021-44228) will be known as the Log4j vulnerability... Analysts at the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) assessed CVE-2021-44228 as a critical vulnerability with a Common Vulnerability Scoring System (CVSS) Base Score of 10.0.
Microsoft warns that Iran-linked APT groups have been observed exploiting the CVE-2023-27350 flaw in attacks against PaperCut MF/NG print management servers. The CVE-2023-27350 flaw is a PaperCut MF/NG Improper Access Control Vulnerability. PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of SYSTEM.
FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange. ... Magic Hound has exploited ... ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)
APT35 , also known as Magic Hound, has confirmed active exploitation of ... ConnectWise ScreenConnect (CVE-2024-1709)
11 more CVEs tied to this actor tracked in Mallory.
Observables
321 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a fake recruitment campaign via LinkedIn and a spoofed hiring portal to deliver a multi-stage malware chain against aerospace and defense professionals.
Iranian state-sponsored espionage activity targeting the U.S. aviation industry, software development sector, and regional defense/aerospace organizations using career-themed phishing and, more recently, SEO poisoning to deliver backdoors including MiniFast and MiniJunk.
Espionage-focused operations targeting defense, aviation, telecommunications, and software organizations using career-themed phishing, fake Zoom installers, and SEO poisoning to deliver updated backdoors during wartime conditions.
Iran-aligned espionage actor affiliated with the IRGC, conducting phishing and SEO-poisoning campaigns against aviation, software, defense, telecommunications, and energy-related targets using fake job offers, spoofed meeting invitations, trojanized software installers, and custom backdoors for persistence and remote command execution.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.