Magic Hound

Magic Hound is Palo Alto Networks Unit 42's designation for the Iranian state-sponsored threat actor known as Charming Kitten and APT35. Active since at least 2014, the group has targeted organizations in Saudi Arabia and across the Middle East, as well as government, defense, and academic targets globally. Magic Hound is characterized by its use of IRC-based malware, spear phishing campaigns, and exploitation of vulnerabilities such as Log4Shell and ProxyShell in enterprise systems. Unit 42 has documented the group's rapid adaptation of newly disclosed vulnerabilities for initial access into targeted environments.