Log in Request a demo

Threat group profile

APT35

Also known as Magic Hound, TA453, COBALT ILLUSION

MITRE ATT&CK describes APT35, also called Charming Kitten or Magic Hound, as an Iranian-sponsored espionage group likely working for the IRGC, and the UK NCSC and Germany's BfV describe its spear-phishing of academics, journalists, NGOs and critics of Iran.

In short

MITRE ATT&CK describes APT35, also called Charming Kitten or Magic Hound, as an Iranian-sponsored espionage group likely working for the IRGC, and the UK NCSC and Germany's BfV describe its spear-phishing of academics, journalists, NGOs and critics of Iran. Start with multi-factor authentication on email and checking unexpected contact through another channel.

Last updated 9 October 2026

Profile MapThreat Group
  1. Attributed OriginIran
  2. Names13names in public reportsMagic Hound · TA453 · COBALT ILLUSION
  3. Sectors7named as targetsGovernment and military · Academia · Journalists and media
  4. Techniques13in the attack chainReconnaissance · Resource Development · Initial Access
  5. Tools8tools and malware listedCharmPower · PowerLess · DownPaper

In one minute

Who they are
MITRE ATT&CK describes it, as Magic Hound, as an Iranian-sponsored espionage group, likely working for the IRGC. The UK NCSC, Germany's BfV, the Canadian Cyber Centre and CERT-EU describe the same names, and the US Treasury (2022) says some sanctioned IRGC activity is partly attributable to APT 35.
Who they target
MITRE lists government and military staff, academics, journalists and groups such as the WHO. The NCSC adds NGOs, think tanks, politicians and activists, and BfV describes critics of the Iranian regime in Germany.
How they usually get in
Mostly social engineering. The NCSC and BfV describe friendly contact, often on personal email, then a link to a fake sign-in page or a video call invite. MITRE also lists exploitation of Exchange, Log4j and Fortinet VPN flaws.
What stands out
It builds trust over days or weeks with fake personas rather than sending bulk phishing. Sources differ on APT42, which several governments list beside Charming Kitten but MITRE does not, and the 2024 US election activity is credited by Treasury to APT 42 and Mint Sandstorm, not to APT35.
What to do first
Turn on multi-factor authentication for email, check unexpected contact through a second channel, disable mail forwarding rules you did not set, and patch exposed mail servers and VPNs.

Names

Public reports use several names for this activity.

Names used for APT35
NameWhere it appears
Magic Hound MITRE ATT&CK group name[1]
TA453 MITRE ATT&CK Associated Groups; UK NCSC[1, 2]
COBALT ILLUSION MITRE ATT&CK Associated Groups; BfV Cyber-Brief 01/2023[1, 6]
Charming Kitten MITRE ATT&CK Associated Groups; UK NCSC; US Treasury 2022; Canadian Cyber Centre; BfV[1, 2, 3, 5, 6]
ITG18 MITRE ATT&CK Associated Groups; UK NCSC[1, 2]
Phosphorus MITRE ATT&CK Associated Groups; US Treasury 2022; BfV[1, 3, 6]
Newscaster MITRE ATT&CK Associated Groups (potential relationship with an older campaign); CERT-EU memo 2019[1, 7]
APT35 MITRE ATT&CK Associated Groups; CERT-EU memo 2019; US Treasury 2022 (written APT 35)[1, 3, 7]
Mint Sandstorm MITRE ATT&CK Associated Groups; BfV; Israel National Digital Agency[1, 6, 10]
APT42 Not on the MITRE list. UK NCSC, BfV, CERT-EU brief 24-03 and the Israeli agency list it beside the names above[2, 6, 8, 10]
Yellow Garuda UK NCSC and BfV, not on the MITRE list[2, 6]
Nemesis Kitten, Tunnel Vision US Treasury 2022 lists them with APT 35 as sets that some of the sanctioned activity can partly be attributed to[3]
Educated Manticore, CharmingCypress Israel National Digital Agency, listed with APT42 and Mint Sandstorm[10]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK page last modified 31 July 2026

    Describes Magic Hound as an Iranian-sponsored group running long term espionage, likely on behalf of the IRGC, with social engineering campaigns since at least 2014.[1]

  • CERT-EU 9 October 2019

    Memo on APT35, also called Phosphorus, Charming Kitten and Newscaster, described as a likely Iran-based actor reportedly targeting accounts tied to the US presidential campaign and academic researchers.[7]

  • US Department of the Treasury 14 September 2022

    Said some activity of sanctioned IRGC-affiliated actors can be partially attributed to APT 35, Charming Kitten, Nemesis Kitten, Phosphorus and Tunnel Vision, while the people do not directly align with a named group.[3]

  • UK National Cyber Security Centre 26 January 2023

    Described Iran-based TA453 (APT42, Charming Kitten, Yellow Garuda, ITG18) as using spear-phishing against the UK and other targets in 2022, separate from the Russia-based SEABORGIUM.[2]

  • German BfV 10 August 2023

    Said it assumes Charming Kitten is involved in espionage against Iranian individuals and organizations in Germany.[6]

  • CERT-EU 1 March 2024

    Cyber security brief calls APT42 (a.k.a. Charming Kitten) an Iranian-origin actor running a campaign against journalists, think tanks and NGOs.[8]

  • Canadian Cyber Centre, with CISA, FBI and other partners 14 May 2024

    Guidance describes Charming Kitten as a group associated with the government of Iran that targets dissidents, human rights groups, media and scholars.[5]

  • CERT-EU 2 May 2025

    Cyber brief reports an attack on a European Parliament member's office, attributed to Iranian group APT42.[9]

  • Israel National Digital Agency November 2025

    Assessed with high confidence that the SpearSpecter campaign is run by Iranian state-aligned operators working with the IRGC Intelligence Organization, and names APT42 and Mint Sandstorm among its aliases.[10]

Where sources differ

Sources differ on names. MITRE lists Mint Sandstorm and Phosphorus as names for Magic Hound but does not list APT42. The UK NCSC, the German BfV and CERT-EU's February 2024 brief put APT42 next to Charming Kitten, and the Israel National Digital Agency lists APT42 and Mint Sandstorm together. Sources also differ on who is behind it. MITRE says likely the IRGC, the Israeli agency says the IRGC Intelligence Organization for the campaign it describes, and the US Treasury in 2022 said the sanctioned people do not directly align with a named group. The US Treasury on 27 September 2024 uses APT 42 and Mint Sandstorm for election-related intrusions but does not name APT35 or Charming Kitten, so this profile does not treat that activity as proven to belong to this group.

Who they target

Sectors

  • Government and militaryMITRE lists government and military personnel in Europe, the US and the Middle East. Treasury lists defense, diplomatic and government personnel. The Israeli agency describes senior defense and government officials and their family members.[1, 3, 10]
  • AcademiaMITRE lists academics. NCSC lists academia in 2022. CERT-EU (2019) says academic researchers focused on Iran were reportedly targeted.[1, 2, 7]
  • Journalists and mediaMITRE lists journalists. NCSC lists journalists and Treasury lists media.[1, 2, 3]
  • NGOs and think tanksNCSC lists NGOs and think tanks. CERT-EU says the February 2024 campaign went after journalism, think tanks and NGOs.[2, 8]
  • Politicians and activistsNCSC lists politicians and activists in 2022. The Canadian guide lists dissidents and human rights groups.[2, 5]
  • Health organizationsMITRE lists organizations such as the World Health Organization.[1]
  • Energy, business services and telecomsTreasury lists these private industries among the targets of the group it sanctioned in 2022.[3]

Regions

  • United States, Europe and the Middle EastMITRE lists European, US and Middle Eastern targets. Treasury lists US and Middle Eastern personnel.[1, 3]
  • United KingdomNCSC says TA453 targeted organizations and individuals in the UK and other areas of interest.[2]
  • GermanyBfV says Charming Kitten is involved in espionage against Iranian individuals and organizations in Germany.[6]
  • European UnionCERT-EU reports an attack on a European Parliament member's office, attributed to APT42, in April 2025.[9]
  • IsraelMITRE ATT&CK says Magic Hound collected credentials from over 900 Fortinet VPN servers in the US, Europe and Israel.[1]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. since at least 2014

    Social engineering campaigns begin

    MITRE ATT&CK dates the group's complex social engineering campaigns to at least 2014.[1]

  2. 9 October 2019

    CERT-EU memo on US election accounts

    CERT-EU reports that APT35 reportedly targeted accounts tied to the US presidential campaign, journalists and prominent Iranians abroad.[7]

  3. February 2021

    New Jersey municipality

    Treasury says the group it sanctioned used a Fortinet flaw to breach a New Jersey municipality, then created accounts and moved sideways.[3]

  4. March and April 2021

    First known encryption activity

    Treasury says the group turned on BitLocker without permission and held the decryption keys for ransom, affecting small businesses.[3]

  5. 2022

    Spear-phishing across sectors

    NCSC says TA453 targeted academia, defense, government, NGOs, think tanks, politicians, journalists and activists.[2]

  6. 2022

    PowerShell backdoors in use

    MITRE says Magic Hound has used the CharmPower and PowerLess backdoors since at least 2022.[11, 12]

  7. 10 August 2023

    Germany warns of spying on critics of Iran

    BfV assesses that Charming Kitten is involved in espionage against Iranian individuals and organizations in Germany, using video chat invitations.[6]

  8. February 2024

    Campaign against journalists, think tanks and NGOs

    CERT-EU reports a campaign by APT42 (a.k.a. Charming Kitten) that used malicious VPN applications to install malware.[8]

  9. April 2025

    European Parliament member's office targeted

    CERT-EU reports a blocked attack on the office of a member of the European Parliament, attributed to APT42, in which hackers impersonated trusted contacts.[9]

  10. November 2025

    SpearSpecter campaign

    The Israel National Digital Agency describes an ongoing campaign by actors it links to APT42 and Mint Sandstorm against senior defense and government officials.[10]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about APT35
DateWhoWhat
9 October 2019 CERT-EU Threat memoPublished a memo on APT35 targeting accounts tied to the US 2020 election.[7]
14 September 2022 US Department of the Treasury (OFAC) SanctionsDesignated ten individuals and two entities affiliated with the IRGC. Treasury says some of their activity can be partially attributed to APT 35, Charming Kitten and other named sets, and that they do not directly align with a named group.[3]
14 September 2022 US Attorney's Office, District of New Jersey Indictment unsealedCharged three of the designated individuals with violating and conspiring to violate the Computer Fraud and Abuse Act, per the Treasury release.[3]
14 September 2022 US Department of State, Rewards for Justice RewardOffered up to 10 million dollars for information on the three charged people or others acting for a foreign government, per the Treasury release.[3]
26 January 2023 UK National Cyber Security Centre AdvisoryPublished an advisory on spear-phishing by TA453 and SEABORGIUM with mitigations.[2]
10 August 2023 German BfV Cyber-BriefPublished a warning about Charming Kitten spying on critics of the Iranian regime, with protective measures.[6]
14 May 2024 Canadian Cyber Centre with CISA, FBI and partner agencies Joint guidancePublished guidance for civil society that describes Charming Kitten among state-linked threats.[5]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Reconnaissance

  • Phishing for Information: Spearphishing Link T1598.003

    MITRE lists SMS and email messages with links designed to steal credentials or track victims.[1]

Resource Development

  • Establish Accounts: Social Media Accounts T1585.001

    Fake LinkedIn and other social media accounts are used to contact targets, per MITRE; NCSC describes fake profiles that impersonate experts.[1, 2]

  • Acquire Infrastructure: Domains T1583.001

    MITRE lists fraudulent domains used for phishing; NCSC says TA453 registers domains to host fake login pages.[1, 2]

Initial Access

  • Phishing: Spearphishing Link T1566.002

    A link to a fake sign-in page is sent after trust is built; NCSC and BfV also describe Zoom and video chat lures.[1, 2, 6]

  • Phishing: Spearphishing via Service T1566.003

    MITRE lists LinkedIn and messaging services such as WhatsApp used to spearphish victims.[1]

  • Exploit Public-Facing Application T1190

    MITRE lists exploitation of Log4j, Exchange servers via ProxyShell and Fortinet VPNs.[1]

Execution

  • Command and Scripting Interpreter: PowerShell T1059.001

    MITRE lists PowerShell for execution and privilege escalation.[1]

Persistence

  • Server Software Component: Web Shell T1505.003

    MITRE lists multiple web shells used to gain execution.[1]

Credential Access

  • OS Credential Dumping: LSASS Memory T1003.001

    MITRE lists dumping of LSASS memory with Task Manager, comsvcs.dll and Mimikatz.[1]

Lateral Movement

  • Remote Services: Remote Desktop Protocol T1021.001

    MITRE lists Remote Desktop used to copy tools across targeted systems.[1]

Collection

  • Email Collection: Remote Email Collection T1114.002

    NCSC says stolen credentials are used to read mail and set up forwarding rules; MITRE lists mail exported from Exchange servers.[1, 2]

Exfiltration

  • Exfiltration Over Web Service T1567

    MITRE lists the Telegram API used to relay data about compromised devices.[1]

Impact

  • Data Encrypted for Impact T1486

    MITRE lists BitLocker and DiskCryptor used to encrypt workstations.[1]

Tools and malware

  • CharmPower Malware

    A modular PowerShell backdoor that MITRE says Magic Hound has used since at least 2022.[1, 11]

  • PowerLess Malware

    A modular PowerShell backdoor that MITRE says Magic Hound has used since at least 2022.[1, 12]

  • DownPaper Malware

    A backdoor whose main job is to download and run second stage malware, per MITRE.[1, 13]

  • Pupy Remote access tool

    An open source remote administration tool; MITRE says Word macros in the group's emails ran scripts to download it.[1, 14]

  • FRP Tunnelling tool

    Fast Reverse Proxy, an open tool MITRE lists for the group; Treasury says a sanctioned group used one on a municipality's server.[1, 3, 15]

  • Mimikatz Credential dumper

    MITRE lists it for pulling plaintext Windows logins and passwords; Treasury also names it.[1, 3, 16]

  • Impacket Tool collection

    An open source set of Python modules for remote execution, credential dumping and relay attacks, listed by MITRE.[1, 17]

  • TAMECAT Malware

    A PowerShell backdoor that the Israeli agency describes in the SpearSpecter campaign, with Telegram and Discord command channels.[10]

Detection and defense

  1. Multi-factor authentication and separate passwords

    Turn on multi-factor authentication for email, webmail and remote logins, and use a different password for each account. Note that BfV says the group has used fake login pages while the one-time code came from the real provider, so also check the page address.

    Counters T1566.002 T1114.002 T1021.001

  2. Verify unexpected contact another way

    Check the identity of new or unusual contacts through a second channel you already trust, such as a phone number you can verify.

    Counters T1566.002 T1585.001 T1598.003

  3. Check links and login pages

    Use only official login pages, check the address bar, and be wary of links that point to user-generated pages on large file or site services.

    Counters T1566.002 T1583.001

  4. Look for mail forwarding rules

    Disable mail forwarding where you can, or check mailbox settings regularly for rules you did not create.

    Counters T1114.002

  5. Patch internet-facing systems

    Apply updates quickly to mail servers, VPNs and other exposed applications, scan them regularly and remove services that need not be public.

    Counters T1190

  6. Check web servers for web shells

    Limit who can change web directories and look for unexpected files on servers that face the internet.

    Counters T1505.003

  7. Protect login secrets in memory

    Turn on Credential Guard and attack surface reduction rules for LSASS and use unique local administrator passwords.

    Counters T1003.001

  8. Keep Remote Desktop off the internet

    Do not leave RDP reachable from the internet, disable it where not needed and require multi-factor authentication for remote logins.

    Counters T1021.001

What Brandefense can do

  • Phishing Monitoring & Domain Abuse

    Find look-alike domains and fake login pages that imitate your brand or your people, so they can be reported and taken down.

  • Executive Protection

    Watch for impersonation of senior staff and for exposed personal accounts, since the sources describe approaches to individuals through personal email and social media.

  • Cyber Threat Intelligence

    Follow what governments and MITRE report about this group and check their listed techniques against your own controls.

  • External Attack Surface Management

    See which of your mail, VPN and web systems are exposed to the internet so flaws of the kind MITRE lists can be fixed first.

  • Dark Web Monitoring

    Watch for leaked or sold company credentials that could be used to log in to email.

Questions

Who is APT35?

MITRE ATT&CK describes it, as Magic Hound, as an Iranian-sponsored espionage group, likely working for the IRGC. It is also called Charming Kitten, TA453, Phosphorus and Mint Sandstorm.

Who does it target?

MITRE lists government and military staff, academics, journalists and bodies like the World Health Organization. The UK NCSC adds NGOs, think tanks, politicians and activists in 2022, and Germany's BfV describes critics of the Iranian regime.

How does it get in?

The NCSC and BfV describe friendly contact, often on personal email, then a link to a fake sign-in page or a video call invite. MITRE also lists exploitation of Exchange, Log4j and Fortinet VPN flaws.

Is APT35 the same as APT42?

Sources differ. The NCSC, BfV and CERT-EU put APT42 next to Charming Kitten, but MITRE does not list APT42 for Magic Hound.

Did the 2024 US election hack-and-leak come from APT35?

The US Treasury names APT 42 and Mint Sandstorm for election-related intrusions in 2024 but does not name APT35 or Charming Kitten, so this profile does not claim it.

What should we do first?

Turn on multi-factor authentication for email, check unexpected contact through a second channel, disable mail forwarding and patch exposed mail and VPN systems.

In our research

  1. APT35: Iran’s Persistent Cyber Espionage Force January 2026
  2. OilRig: Iran’s Persistent Espionage Arm in Cyberspace December 2025
  3. APT33 (Elfin / Refined Kitten): Iran’s Longstanding Cyber-Espionage Arm November 2025
  4. BellaCiao: The New Malware From Iran’s Charming Kitten May 2023
  5. European Focused Threat Actors – APT Groups September 2022

Sources

  1. Magic Hound, Group G0059 MITRE ATT&CK Supports: Names, description, techniques, software list
  2. SEABORGIUM and TA453 continue their respective spear-phishing campaigns against targets of interest UK National Cyber Security Centre Supports: Names, sectors in 2022, spear-phishing method, mitigations
  3. Treasury Sanctions IRGC-Affiliated Cyber Actors for Roles in Ransomware Activity US Department of the Treasury Supports: 14 September 2022 sanctions, partial attribution to APT 35 and Charming Kitten, indictment, reward
  4. Treasury Sanctions Iranian Regime Agents Attempting to Interfere in U.S. Elections US Department of the Treasury Supports: 27 September 2024 use of the names APT 42 and Mint Sandstorm for election-related activity
  5. Mitigating cyber threats with limited resources: Guidance for civil society Canadian Centre for Cyber Security with CISA, FBI and partner agencies Supports: 14 May 2024 description of Charming Kitten
  6. BfV Cyber-Brief No. 01/2023, Advisory on cyber espionage against critics of the Iranian regime in Germany German Federal Office for the Protection of the Constitution (BfV) Supports: Method, targets in Germany, names, protective measures
  7. Iran's APT35 targeting individuals tied to US 2020 elections (Memo 191009-1) CERT-EU Supports: 9 October 2019 memo on APT35 and campaign-related accounts
  8. Cyber Security Brief 24-03, February 2024 CERT-EU Supports: APT42 (a.k.a. Charming Kitten) campaign against journalists, think tanks and NGOs
  9. Cyber Brief 25-05, April 2025 CERT-EU Supports: Attack on a European Parliament member's office attributed to APT42
  10. SpearSpecter: Unmasking Iran's IRGC Cyber Operations Targeting High-Profile Individuals Israel National Digital Agency Supports: November 2025 ongoing campaign by APT42 and Mint Sandstorm, TAMECAT
  11. CharmPower (S0674) MITRE ATT&CK Supports: Modular PowerShell backdoor used since at least 2022
  12. PowerLess (S1012) MITRE ATT&CK Supports: Modular PowerShell backdoor used since at least 2022
  13. DownPaper (S0186) MITRE ATT&CK Supports: Backdoor that downloads second stage malware
  14. Pupy (S0192) MITRE ATT&CK Supports: Open source remote administration tool
  15. FRP (S1144) MITRE ATT&CK Supports: Fast Reverse Proxy tool
  16. Mimikatz (S0002) MITRE ATT&CK Supports: Credential dumper
  17. Impacket (S0357) MITRE ATT&CK Supports: Open source network protocol and credential tools
  18. Phishing: Spearphishing Link (T1566.002) MITRE ATT&CK Supports: Mitigations
  19. Exploit Public-Facing Application (T1190) MITRE ATT&CK Supports: Mitigations
  20. Server Software Component: Web Shell (T1505.003) MITRE ATT&CK Supports: Mitigations
  21. OS Credential Dumping: LSASS Memory (T1003.001) MITRE ATT&CK Supports: Mitigations
  22. Remote Services: Remote Desktop Protocol (T1021.001) MITRE ATT&CK Supports: Mitigations
  23. Email Collection: Remote Email Collection (T1114.002) MITRE ATT&CK Supports: Mitigations

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Spear phishing

Spear phishing is phishing aimed at a chosen person or group instead of a large crowd.

Read more

Threat group

Star Blizzard

Attributed by the UK, US, Australian, Canadian and New Zealand governments to Russia's Federal Security Service (FSB) Center 18, this group is linked to long phishing campaigns against politicians, researchers, journalists and government staff in the UK, US and other NATO countries. It steals email logins and reads the victims' mail.

Read more

Threat group

APT42

MITRE ATT&CK describes APT42 as an Iranian-sponsored threat group that conducts cyber espionage and surveillance, active since at least 2015. Israel's National Digital Agency says it works in line with the IRGC Intelligence Organization, and the UK NCSC warned in 2023 about its patient spear-phishing of academics, officials, journalists and NGOs.

Read more