Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Phlox Tempest (threat actor)

Risk

Medium

0 techniques 40 tools/malware 2 vulnerabilities 2 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2017-0005

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

BARIUM Chollima Citrine Sleet Cobalt Dark DarkHotel Emissary Global Hafnium Imperial Kitten Indrik Spider Jackal Labyrinth Labyrinth Chollima Luna Lynx Malware Mango Matrix Mirage Moonstone Sleet Mythic Naikon Nobelium Pink Poseidon Sednit Smoke Sandstorm Snake Sponsor TeamSpy Tsunami Turla Velvet Chollima Void Volt Typhoon Wicked Winnti crimson phishing

Indicators of Compromise (2)

Domain

360.net

Filename

MicrosoftMapping.json

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Phlox Tempest

Type: Unknown Active

DEV-0796 malicious actors APT groups hackers the Newscaster Team +23 more

Infrastructure 1 IOC(s)

50%

Domain

360.net

Artifacts (1)

MicrosoftMapping.json

Capability

50%

40 tool(s)/malware 2 CVE(s)

BARIUM Chollima Citrine Sleet Cobalt Dark DarkHotel Emissary Global +32

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy media aerospace education think-tank information-technology maritime manufacturing pharmaceutical chemical mining healthcare legal-services gaming utilities hospitality nuclear entertainment

Targeted Countries

US CN IR IN RU GB IL JP DE KR SA KP TW TR FR CA VN AU KZ PK UA PL AE SG NL BR ES IQ BY IT SY MX RO LB EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges