Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-1575 (threat actor)

Risk

High

18 techniques 40 tools/malware 6 vulnerabilities 4 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2023-23397

CVE CVE-2023-32434

CVE CVE-2023-32435

CVE CVE-2023-38606

CVE CVE-2023-38831

CVE CVE-2023-41990

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1404

T1409

T1418

T1420

T1422

T1424

T1426

T1429

T1430

T1437

T1521

T1533

T1544

T1575

T1630

T1634

T1636

T1658

Stage risk: Critical High Medium None

Tools & Malware (40)

Chollima Cobalt Dadsec platform Dark FlowerStorm Global GoldDigger Hancitor Imperial Kitten Labyrinth Labyrinth Chollima Leverage Luna Lynx Malware Matrix Microsoft Defender XDR MuddyWater Phishing Kit Phishing campaigns Phoenix Pink Qilin Qilin Ransomware RansomHub STOP ShadowSyndicate SideWinder SilabRAT Telegram TriangleDB Trojan Trojans Tsunami Tycoon Unknown Velvet Chollima VietCredCare WhatsApp phishing

Indicators of Compromise (4)

Domain

ANY.RUN Forbes.ru

Filename

mobile-attack-v17.1.xlsx tidal-campaigns.json

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-1575

Type: Unknown Active

SnappyClient YoroTrooper

Infrastructure 2 IOC(s)

50%

Domain

ANY.RUN Forbes.ru

Artifacts (2)

mobile-attack-v17.1.xlsx tidal-campaigns.json

Capability

50%

18 technique(s) 40 tool(s)/malware 6 CVE(s)

Chollima Cobalt Dadsec platform Dark FlowerStorm Global GoldDigger Hancitor +32

T1404 T1409 T1418 T1420 +14

Victim

70%

Targeted Sectors

financial-services defense government media aviation manufacturing retail healthcare telecommunications non-profit transportation critical-infrastructure education think-tank

Targeted Countries

RU US SG AU VN IN IL FR IT RO EG BR NL KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges