Palo Alto Networks Unit 42 documented in a report published on Unit 42 the Magic Hound espionage campaign — active since at least mid-2016 and targeting organizations in the energy, government, and technology sectors with operations in Saudi Arabia. Over 50 samples were collected spanning IRC bots, .NET downloaders, custom droppers, executables, and the open-source Pupy Python RAT, delivered exclusively through social engineering via malicious Office document macros and spearphishing links — no exploit code was used. Infrastructure analysis revealed a potential relationship with the Iran-linked Rocket Kitten (Operation Saffron Rose/Ajax Security Team) adversary group.
Delivery Infrastructure: Compromised Websites and Lookalike Domains
Weaponized Word and Excel documents were hosted on compromised legitimate government and energy sector websites, as well as lookalike domains: ntg-sa[.]com spoofing a Saudi ICT conglomerate, mol.com-ho[.]me spoofing the Ministry of Labor, and its.com-ho[.]me. Lure documents impersonated Saudi Ministry of Health and Ministry of Commerce mandatory forms requiring macro enablement, with additional themes including holiday greetings cards and government administrative documents. The majority of samples share the author metadata field "gerry knight" — a distinctive artifact enabling clustering. Most macros used direct IP-based C2 connections; two documents used www1.chrome-up[.]date and www3.chrome-up[.]date, which served as pivot points expanding the infrastructure map across four tool categories: downloaders, droppers, loaders, and payloads.
Five-Tool Custom Malware Suite
MagicHound.Rollover (document loader): Malicious macros in Word/Excel documents use PowerShell to download shellcode-based payloads, with one technique using the open-source Magic Unicorn module for Meterpreter delivery ("one line shellcode injection with native x86 shellcode"). MagicHound.Fetch (executable loader): Downloads secondary payloads via a Magic Unicorn-generated PowerShell command to http://www7.chrome-up[.]date/0m5EE; establishes persistence by dropping c:\temp\rr.exe and creating autorun registry keys. Strings are AES-encrypted with the hardcoded key agkrhfpdbvhdhrkj. MagicHound.DropIt (dropper): Decodes base64-encoded blobs, concatenates them into an executable written to %TEMP%, and can operate as a binder — executing a legitimate decoy (e.g., Flash installer) alongside the malicious payload. MagicHound.Retriever (downloader): A .NET downloader using SoapHttpClientProtocol to communicate with C2 via SOAP HTTP requests. MagicHound.Leash (IRC bot): Receives commands via PRIVMSG from operators whose IRC nicknames start with "AS_" or "AF_"; shows 67% binary similarity to the Parastoo IRC bot from iSight's NEWSCASTERS report, sharing the same nickname prefix requirements and VER command response patterns.
Pupy RAT and Rocket Kitten Infrastructure Overlap
The campaign also deployed Pupy — an open-source Python RAT with cross-platform Windows (32/64-bit DLL), macOS, Linux, and Android loaders — configured with the "obfs3" Threebfuscator transport (a Tor Project obfuscation method) to conceal TCP communications. The Rocket Kitten connection materializes through an MPK IRC bot sharing the same C2 IP as a Leash sample — MPK being a non-public tool previously attributed exclusively to Rocket Kitten with significant behavioral and code overlap against the CheckPoint-documented MPK Trojan variant. While infrastructure reuse between two espionage actors in the same region is suggestive of a relationship, Unit 42 assessed it as potential without conclusive corroboration.