Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TA2552 (threat actor)

Risk

Medium

1 techniques 40 tools/malware 0 vulnerabilities 39 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1496

Resource Hijacking impact

Stage risk: Critical High Medium None

Tools & Malware (40)

Agent Tesla Alien Backdoors BeaverTail BlackCat Cobalt Curl Dark Emotet Enfal Ghost RAT Global HAVEX RAT INVISIBLEFERRET Jackal Leverage Makop Makop Ransomware Malware Mechanical Mimikatz Nexus PittyTiger Poison Ivy Quasar Quasar RAT SMAUG STOP SUNBURST Satori Sednit Sofacy SolarWinds TEARDROP Unknown Void WAVESHAPER Wicked malware distribution phishing

Indicators of Compromise (39)

Domain

rs.3.rs e18220.com is15720.xyz e29120.com rr020920.xyz e180320.xyz i5320.xyz r25820.xyz +21 more

Email Address

shahidehnr@ksu.edu jesse.poland@kaust.edu.sa

URL

http://app452-sat-mx.i3720.xyz/leap/983.php http://www-registros-appsmx-sat.x030720.xyz/regs/autoriza.php http://485online.rs10720.xyz/xPsY http://akglass.in/menu/redirect.php http://printstockphoto.com/img/01/redirect.html http://apps-registros-mx.is15720.xyz/1/auth.php http://www-netfflix-registros.i10720.xyz/regs/autoriza.php http://www-registros-apps-mx.e18220.com/1/autoriza.php

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Detection Coverage

1 strategies

1/7 stages covered

Actions on Objectives (1)

DET0267 Resource Hijacking Detection Strategy

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

TA2552

Type: Unknown Active

APT28 Pawn Storm Fancy Bear Sednit web skimming

Infrastructure 37 IOC(s)

50%

Domain

rs.3.rs e18220.com is15720.xyz e29120.com rr020920.xyz +24

URL

Artifacts (2)

shahidehnr@ksu.edu jesse.poland@kaust.edu.sa

Capability

50%

1 technique(s) 40 tool(s)/malware

Agent Tesla Alien Backdoors BeaverTail BlackCat Cobalt Curl Dark +32

impact

T1496

Victim

70%

Targeted Sectors

government non-profit think-tank defense energy

Targeted Countries

IR IL SA US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

7 Actions on Objectives

Capability (Techniques)

T1496

Capability (Malware)

Agent Tesla Alien Backdoors

Infrastructure

rs.3.rs e18220.com is15720.xyz