{
	"id": "922ea7e5-eac1-42af-bceb-94a9a95329c4",
	"created_at": "2026-04-06T00:08:42.540541Z",
	"updated_at": "2026-04-10T03:24:47.383175Z",
	"deleted_at": null,
	"sha1_hash": "ce2bee12cda1203962deba30493bb36dd3213dfc",
	"title": "Magic Kitten - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 57919,
	"plain_text": "Magic Kitten - Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 18:37:12 UTC\n APT group: Magic Kitten\nNames\nMagic Kitten (CrowdStrike)\nVOYEUR (NSA)\nCountry Iran\nSponsor State-sponsored\nMotivation Information theft and espionage\nFirst seen 2007\nDescription\n(CEIP) In January 2015, the German news outlet Der Spiegel released previously unpublished\ndocuments on cyber espionage conducted by American intelligence agencies.50 One of them\nrevealed an NSA tactic labeled “fourth party collection,” which is the practice of breaking into\nthe command and control infrastructure of foreign-state-sponsored hackers to look over their\nshoulders. The presentation describes a real-life example of acquiring intelligence and stealing\nvictims from a group code-named VOYEUR by the NSA, otherwise known as Magic Kitten.\nMagic Kitten appears to be among the oldest and most elaborate threat actors originating in\nIran. It is also distinct from other groups because of its apparent relationship with the Iranian\nMinistry of Intelligence rather than the IRGC. However, Magic Kitten’s activities mirror those\nof other groups, with the primary targets being Iranians inside Iran and Tehran’s regional\nrivals. The earliest observed samples of Magic Kitten’s custom malware agent dates to 2007,\nwell before other known malware apparently originated, and the threat actor continues to be\nactive.\nObserved\nCountries: Germany, India, Indonesia, Iraq, Lebanon, Netherlands, Pakistan, Qatar, Sweden,\nSwitzerland, Thailand, UAE.\nTools used\nInformation\nLast change to this card: 31 December 2022\nDownload this actor card in PDF or JSON format\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=db2c5058-0f53-4aab-ac65-95f1504c9892\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=db2c5058-0f53-4aab-ac65-95f1504c9892\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=db2c5058-0f53-4aab-ac65-95f1504c9892\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=db2c5058-0f53-4aab-ac65-95f1504c9892"
	],
	"report_names": [
		"showcard.cgi?u=db2c5058-0f53-4aab-ac65-95f1504c9892"
	],
	"threat_actors": [
		{
			"id": "e575ba5a-702c-4a64-9bda-c4b1061210e5",
			"created_at": "2022-10-25T16:07:23.245788Z",
			"updated_at": "2026-04-10T02:00:04.763889Z",
			"deleted_at": null,
			"main_name": "Magic Kitten",
			"aliases": [],
			"source_name": "ETDA:Magic Kitten",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "efeeab6a-219e-4a45-9b2f-9f77c647ffd2",
			"created_at": "2023-01-06T13:46:38.370366Z",
			"updated_at": "2026-04-10T02:00:02.946455Z",
			"deleted_at": null,
			"main_name": "Magic Kitten",
			"aliases": [
				"Group 42"
			],
			"source_name": "MISPGALAXY:Magic Kitten",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434122,
	"ts_updated_at": 1775791487,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ce2bee12cda1203962deba30493bb36dd3213dfc.pdf",
		"text": "https://archive.orkl.eu/ce2bee12cda1203962deba30493bb36dd3213dfc.txt",
		"img": "https://archive.orkl.eu/ce2bee12cda1203962deba30493bb36dd3213dfc.jpg"
	}
}