Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

BlackJack (threat actor)

Risk

High

6 techniques 40 tools/malware 9 vulnerabilities 25 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2018-0171

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-8088

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T0806

T0809

T0814

T0822

T0829

T0883

Stage risk: Critical High Medium None

Tools & Malware (40)

Backdoors Charon ClickFix EAGLET FrostyGoop Fuxnet malware GOFFEE Gentlemen GhostRedirector Global Graphite Gunra Interlock Interlock ransomware Leverage Malware MiniJunk Minibike Mythic Nimbus Manticore Paper Werewolf Paper Werewolf/GOFFEE Payload Payload PhantomCore Phishing campaigns PipeMagic PlugX PowerShell RomCom Static Tundra Subtle Snail Telegram ToolShell Unknown VOLTZITE WarLock Winrar phishing phishing emails

Indicators of Compromise (25)

Domain

Hunt.io MarylandReporter.com BJ21.com ASP.NET SSL.com BlackjackInfo.com FalconFeeds.io careers.com +4 more

Email Address

leslie@kesscomm.com

Filename

dogovor.vbe application.vbe contract-2025-5.vbe Edge.exe msedge.dll rundll32.exe cmd.exe 2025-5.vbe +2 more

IPv4 Address

26.2.5.11 25.3.2.20

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

BlackJack

Type: Unknown Active

21 Storm-0978 Tropical Scorpius UNC2596 Crouching Yeti +19 more

Infrastructure 14 IOC(s)

50%

Domain

Hunt.io MarylandReporter.com BJ21.com ASP.NET SSL.com +7

IPv4 Address

26.2.5.11 25.3.2.20

Artifacts (11)

leslie@kesscomm.com dogovor.vbe application.vbe contract-2025-5.vbe Edge.exe msedge.dll +5

Capability

50%

6 technique(s) 40 tool(s)/malware 9 CVE(s)

Backdoors Charon ClickFix EAGLET FrostyGoop Fuxnet malware GOFFEE Gentlemen +32

T0806 T0809 T0814 T0822 +2

Victim

70%

Targeted Sectors

telecommunications manufacturing financial-services defense government critical-infrastructure transportation education energy healthcare retail oil-gas aerospace aviation media mining food-agriculture construction utilities entertainment gaming legal-services hospitality chemical

Targeted Countries

RU UA US BY KZ BR AU CN TW CA SG VN TR PL JP GB EG IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges