APT / THREAT GROUP

TA453

🇮🇷Iran-attributed
1
campaigns
9
aliases
Last seen:Mar 17, 2026

Intelligence Profile

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)

Threat Analysis

TA453 is a known-sophistication threat actor attributed to Iran, engaged in cyber operations with a primary motivation of unknown activity patterns.

Known Campaigns

TA453 — Active Operations March 2026

TA453 is a unknown-motivation threat actor attributed to Iran. TA453 has employed the use of compromised accounts, malware, and confrontational lures to go after targets with a range of backgrounds from medical researchers to realtors to travel agencies....

ACTIVEMEDIUM2026

External References

Quick Facts

TypeAPT / Threat Group
Origin🇮🇷 Iran
Aliases9
SourceMalpedia

Also Known As

NewscasterCharming KittenPhosphorusTA453COBALT ILLUSIONITG18Magic HoundAPT35Mint Sandstorm

Research Links

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
TA453 — APT / Threat Group | Threat Intelligence | CTIWATCH.COM