Magic Hound

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.^[7][18]

Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.^[19]

Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.^{[3][2][6][5][20][18]}

Magic Hound has created local accounts named help and DefaultAccount on compromised machines.^[17][18]

Magic Hound malware has used Registry Run keys to establish persistence.^[15][19][18]

Magic Hound has used PowerShell for execution and privilege escalation.^{[15][1][17][19][18]}

Magic Hound has used compromised domains to host links targeted to specific phishing victims.^{[2][5][3][20]}

Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.^[2]

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.^[1][17][19]

Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.^{[1][17][19][18]}

Magic Hound has captured the user-agent strings from visitors to their phishing sites.^[20]

Magic Hound has collected location information from visitors to their phishing sites.^[20]

Magic Hound has captured the IP addresses of visitors to their phishing sites.^[20]

Magic Hound enabled and used the default system managed account, DefaultAccount, via "powershell.exe" /c net user DefaultAccount /active:yes to connect to a targeted Exchange server over RDP.^[19]

Magic Hound has used multiple web shells to gain execution.^[17][19]

Magic Hound has used base64-encoded commands.^[15][18]

Magic Hound has attempted to lure victims into opening malicious links embedded in emails.^[2][3]

Magic Hound has removed mailbox export requests from compromised Exchange servers.^[17]

Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.^[17]

Magic Hound malware can use a SOAP Web service to communicate with its C2 server.^[15]

Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.^[3]

Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.^{[23][1][7][19][18]}

Magic Hound has used Powershell to discover email accounts.^[17]

Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.^[11]

Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.^[1]

Magic Hound malware is capable of keylogging.^[15]

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.^[17][19]

Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.^{[24][2][3][18]}

Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.^[15]

Magic Hound has used scheduled tasks to establish persistence and execution.^[17][19]