Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Operation Red Signature (threat actor)

Risk

High

1 techniques 40 tools/malware 40 vulnerabilities 40 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2007-5633

CVE CVE-2009-0824

CVE CVE-2010-1592

CVE CVE-2013-2618

CVE CVE-2013-3893

CVE CVE-2014-0322

CVE CVE-2014-1776

CVE CVE-2014-4114

CVE CVE-2014-8361

CVE CVE-2015-1805

CVE CVE-2015-2545

CVE CVE-2015-5119

CVE CVE-2015-5122

CVE CVE-2016-3353

CVE CVE-2017-0143

CVE CVE-2017-0144

CVE CVE-2017-0176

CVE CVE-2017-1000353

CVE CVE-2017-10271

CVE CVE-2017-11467

CVE CVE-2017-11882

CVE CVE-2017-12629

CVE CVE-2017-5638

CVE CVE-2017-7269

CVE CVE-2017-8570

CVE CVE-2017-8759

CVE CVE-2017-9822

CVE CVE-2018-0101

CVE CVE-2018-0171

CVE CVE-2018-10561

CVE CVE-2018-10562

CVE CVE-2018-2628

CVE CVE-2018-4878

CVE CVE-2018-7600

CVE CVE-2018-7602

CVE CVE-2018-8174

CVE CVE-2021-35211

CVE CVE-2023-38831

CVE CVE-2024-21412

CVE CVE-2104-4114

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T9000

Stage risk: Critical High Medium None

Tools & Malware (40)

9002 RAT Aurora Backdoors BlackEnergy Carbanak Cobalt Cobalt Strike Confucius Dark Dridex Emotet GitHub Global Hidden Cobra Malware Malwarebytes MiniDuke Mirai Monero Miner MuddyWater OceanLotus OilRig Patchwork Play PlugX Poison Ivy PowerShell Regin SamSam Sednit SentinelOne Sofacy Stuxnet Trojan Turla Unknown Winnti Zebrocy Zscaler phishing

Indicators of Compromise (40)

Domain

TextHelp.com ico.org.uk uvahealth.com uscourts.gov download.cnet.com Naukri.com 7.ai ilgiornale.it +11 more

Email Address

herbapproach@protonmail.com

Filename

file001.zip ssms.exe oci.dll index.csv rcview40u.dll rcview.log update.zip printdat.dll +8 more

SHA-1 Hash

4ae4aed210f2b4f75bdb855f6a5c11e625d56de2

SHA-256 Hash

bcfacc1ad5686aee3a9d8940e46d32af62f8e1cd1631653795778736b67b6d6e

IPv4 Address

66.42.37.101 207.148.94.157

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Operation Red Signature

Type: Unknown Active

Flying Kitten Travnet Xenotime fileless Agrius +21 more

Infrastructure 21 IOC(s)

50%

Domain

TextHelp.com ico.org.uk uvahealth.com uscourts.gov download.cnet.com +14

IPv4 Address

66.42.37.101 207.148.94.157

Artifacts (19)

herbapproach@protonmail.com file001.zip ssms.exe oci.dll index.csv rcview40u.dll +13

Capability

50%

1 technique(s) 40 tool(s)/malware 40 CVE(s)

9002 RAT Aurora Backdoors BlackEnergy Carbanak Cobalt Cobalt Strike Confucius +32

T9000

Victim

70%

Targeted Sectors

financial-services government defense energy non-profit healthcare education media telecommunications critical-infrastructure aerospace manufacturing hospitality pharmaceutical transportation think-tank retail maritime mining gaming oil-gas utilities entertainment chemical information-technology aviation nuclear

Targeted Countries

US CN KR RU KP IN IR JP UA GB PK VN IL BY AE TW KZ MX SA TR FR LB PL AU NL IT SY CA EG NG IQ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges