Magic Hound Campaign Attacks Saudi Targets
Summary: Unit 42 documented a Middle East espionage campaign it named Magic Hound, active since at least mid-2016 and aimed mainly at energy, government, and technology organizations based in or with business interests in Saudi Arabia. The campaign used weaponized Word and Excel documents with malicious macros that called PowerShell to fetch payloads including the Pupy RAT and Meterpreter, with more than fifty tool samples collected and the earliest compile timestamp in May 2016.
What you should know: The delivery documents were hosted on compromised legitimate websites belonging to government and energy organizations and on domains spoofing a Saudi technology conglomerate and the Ministry of Labor, so a link arriving from a familiar-looking source was the attack. Unit 42 also found a shared command-and-control IP linking Magic Hound to the Rocket Kitten group's MPK bot, a connection it could not conclusively confirm.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026