Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Cyber.Anarchy.Squad (threat actor)

Risk

Medium

1 techniques 40 tools/malware 4 vulnerabilities 1 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2018-0171

CVE CVE-2025-43300

CVE CVE-2025-9132

CVE CVE-2025-9363

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1567.002

Exfiltration to Cloud Storage exfiltration

Stage risk: Critical High Medium None

Tools & Malware (40)

AdWind Cobalt Dark Echelon GitHub Global Kazuar Kimsuky LNK files Malicious LNK files Malware Payload Play PowerShell PowerShell scripts Qilin Qilin Ransomware Revenge RAT Royal Scheduled Tasks Sednit SentinelOne Sofacy Spark RAT SparkRAT Spear-phishing Spear-phishing emails Static Tundra Synful Knock Telegram Teleport Unknown VShell VShell backdoor Warsaw XDSpy XWorm XenoRAT malware distribution phishing

Indicators of Compromise (1)

Domain

Congress.gov

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

1 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Actions on Objectives (1)

M1021 Restrict Web-Based Content

Detection Coverage

1 strategies

1/7 stages covered

Actions on Objectives (1)

DET0570 Detection Strategy for Exfiltration to C...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Cyber.Anarchy.Squad

Type: Unknown Active

Cyber Anarchy Squad APT28 Cozy Bear Pawn Storm Sednit +4 more

Infrastructure 1 IOC(s)

50%

Domain

Congress.gov

Capability

50%

1 technique(s) 40 tool(s)/malware 4 CVE(s)

AdWind Cobalt Dark Echelon GitHub Global Kazuar Kimsuky +32

exfiltration

T1567.002

Victim

70%

Targeted Sectors

telecommunications government non-profit pharmaceutical financial-services manufacturing media energy critical-infrastructure gaming healthcare maritime education

Targeted Countries

RU UA BY PL US IR KR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

7 Actions on Objectives

Capability (Techniques)

T1567.002

Capability (Malware)

AdWind Cobalt Dark

Infrastructure

Congress.gov