Procedure examples

Magic Hound malware has used Registry Run keys to establish persistence.

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.

Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.

Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.

Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.

Magic Hound has used the Telegram API `sendMessage` to relay data on compromised devices.

Magic Hound has copied tools within a compromised network using RDP.

Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.

Magic Hound has used Plink to tunnel RDP over SSH.

Magic Hound has used an encrypted http proxy in C2 communications.

Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.

Magic Hound has acquired Amazon S3 buckets to use in C2.

Magic Hound has used compromised domains to host links targeted to specific phishing victims.

Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.

Magic Hound has established email accounts using fake personas for spearphishing operations.

Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.

Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.

Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.

Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.

Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.

Magic Hound has captured the IP addresses of visitors to their phishing sites.

Magic Hound has collected location information from visitors to their phishing sites.

Magic Hound has captured the user-agent strings from visitors to their phishing sites.

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.

Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.

Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.

Magic Hound has executed scripts to disable the event log service.

Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.