Magic Hound

APT35 is an Iranian state-sponsored cyber espionage actor widely associated with the Islamic Revolutionary Guard Corps, including reporting that links elements of the activity to the IRGC Intelligence Organization. The cluster is tracked under numerous aliases including Charming Kitten, Phosphorus, Mint Sandstorm, TA453, Magic Hound, Cobalt Illusion, Cobalt Mirage, NewsBeef, Newscaster, Agent Serpens, Imperial Kitten, Yellow Liderc, ITG18, Houseblend, Smoke Sandstorm, UNC1549, Nimbus Manticore, Curium, and related designations used by different vendors. Some of these names may refer to overlapping subclusters or partially distinct operational teams rather than a perfectly uniform single entity, but they are consistently tied to Iranian intelligence collection activity. The actor has been active since at least the mid-2010s and is known primarily for espionage, credential theft, and long-term access operations in support of Iranian strategic interests. Targeting has included government officials, diplomats, military personnel, defense contractors, aerospace and aviation organizations, journalists, academics, think tanks, researchers, dissidents, human rights organizations, telecommunications providers, energy firms, healthcare entities, technology companies, and religious or policy figures. Geographic focus has spanned Iran’s regional adversaries and areas of strategic interest, including Israel, Saudi Arabia, the UAE, Jordan, Iraq, Turkey, the broader Middle East, as well as the United States, the United Kingdom, Europe, and parts of South and East Asia. APT35 is especially known for high-touch social engineering. Operators frequently impersonate journalists, recruiters, researchers, policy institutions, podcast hosts, and other trusted personas, often sustaining prolonged email exchanges before delivering phishing links or malware. Campaigns have used fake webinar portals, job offers, interview invitations, healthcare-themed lures, policy documents, and spoofed cloud-service login pages to harvest credentials. The group has also been associated with vishing, spam-bombing as a precursor to phone-based social engineering, and more recently AI-enhanced phishing and voice impersonation. Operational tradecraft includes extensive credential harvesting, account compromise, mailbox theft, and use of valid accounts for follow-on espionage. The actor has repeatedly used fake login pages for major webmail and cloud platforms, and has deployed tooling to extract email contents after obtaining credentials or session material. In parallel with its social-engineering heritage, the group has matured technically and has been observed weaponizing newly disclosed vulnerabilities in public-facing systems, including enterprise email, remote management, collaboration, and edge security products. Reporting also links the actor to exploitation of Microsoft Exchange, Log4Shell-related flaws, Zoho ManageEngine, IBM Aspera Faspex, PaperCut, Fortinet, Zimbra, WinRAR, and other exposed technologies. Malware and tooling associated with APT35 and its related clusters include CharmPower or POWERSTAR, BASICSTAR, BellaCiao, BellaCPP, Hyperscrape, PowerLess, GorjolEcho, KORKULOADER, LittleLooter, Drokbk, BlackSmith, and AnvilEcho, among others. Capabilities observed across these tools include reconnaissance, command execution, persistence, credential and mailbox theft, file discovery, screenshot and audio collection, browser-data theft, keylogging-related collection, payload staging, and data exfiltration. Some operations have used .NET AppDomain hijacking and DLL sideloading chains, including activity attributed to UNC1549 or Nimbus Manticore against aerospace, aviation, defense, and technology targets. Related subgroups have also used dead-drop resolver techniques, cloud-hosted infrastructure, and legitimate services to conceal command-and-control. Commonly reported techniques include spearphishing attachments and links, user-execution lures, PowerShell-based execution, registry-based persistence, registry modification for defense evasion, system, user, network, and file discovery, hidden-window execution, and HTTP or HTTPS command-and-control. The actor has also used cloud services and developer or collaboration platforms as part of delivery, staging, or command infrastructure, and has shown a preference for blending malicious activity with legitimate web traffic and trusted services. APT35 remains one of the most prolific and adaptive Iranian espionage actors. Its operations combine persistent social engineering, credential-centric intrusion methods, selective malware deployment, and increasingly rapid exploitation of newly disclosed vulnerabilities. The group’s activity consistently aligns with Iranian intelligence priorities, particularly surveillance of regional rivals, policy communities, critical sectors, and individuals of strategic interest.