Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC5266 (threat actor)

Risk

100

Critical

27 techniques 40 tools/malware 10 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1590.006

Network Security Appliances reconnaissance

›

2 Weaponization

T1583.003

Virtual Private Server resource development

T1588

Obtain Capabilities resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

CVE CVE-2019-11539

CVE CVE-2020-8218

CVE CVE-2022-3019

CVE CVE-2022-30190

CVE CVE-2023-46805

CVE CVE-2024-21887

CVE CVE-2024-21893

CVE CVE-2024-24919

CVE CVE-2024-3400

CVE CVE-2025-22457

›

5 Installation

T1010

Application Window Discovery discovery

T1016

System Network Configuration Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1518

Software Discovery discovery

›

6 Command & Control

T1113

Screen Capture collection

T1071.001

Web Protocols command and control

T1095

Non-Application Layer Protocol command and control

T1571

Non-Standard Port command and control

›

7 Actions on Objectives

T1222

File and Directory Permissions Modification defense impairment

T1553

Subvert Trust Controls defense impairment

T1496

Resource Hijacking impact

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1055

Process Injection stealth

T1070

Indicator Removal stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1622

Debugger Evasion stealth

Stage risk: Critical High Medium None

Tools & Malware (40)

Agent Tesla Anatsa BLINDINGCAN BRICKSTORM BRICKSTORM malware BeaverTail CHINACHOPPER Carbon Cobalt Cobalt Strike Curl Custom malware Emotet Gemini Gh0st Ghost RAT Global HAVEX RAT Hafnium INVISIBLEFERRET KongTuke Leslieloader Lynx Malware Nexus Pantegana PlugX SPAWNANT SPAWNMOLE Sliver SparkRAT TONERJAM Trojan Volt Typhoon WARPWIRE WARPWIRE Variant WAVESHAPER YARA gh0st RAT web shell

Indicators of Compromise (40)

Domain

360.net Mallory.ai gofile.io pan.xj.hk Gofile.io crt.sh Crt.sh hackertarget.com +3 more

Filename

logd.spec.cfg

MD5 Hash

4f79c70cce4207d0ad57a339a9c7f43c e7d24813535f74187db31d4114f607a1 4acfc5df7f24c2354384f7449280d9e0 bb3b286f88728060c80ea65993576ef8 4645f2f6800bc654d5fa812237896b00

SHA-256 Hash

dba860617762bc713771de351026eb683546b37489fa0359064948f263438030 675874ac8fbe66e76244759ae398a4d30da84ef2435a1384c4be549ca9eba18b 8679a25c78e104c6e74996b75882e378f420614fe1379ee9c1e266a11ffa096d 06e87a03507213322d876b459194021f876ba90f85c5faa401820954045cd1d2 1e37efcd3cd647e6ce5414ae8e353ca690c2d3f7a701a1cc2ec29a4813f5c90b 134ed0407956ff1ac59f38e89742e357cc3be565cbaff18b424ed1bcfd130978 2bee2cc42322e928bfa0650c5416b14bc0200f2d1156304179d63982baa835dc 9a1077f57bac5610d44ac46a8958dd5469522a3db466f164f4dfeada73847b79

IPv4 Address

205.185.124.24 34.85.128.214 209.141.57.116 107.189.8.240 205.185.126.208 198.98.50.218 47.103.218.35 45.61.187.124 +6 more

URL

http://login.offiec.us.kg/ms-help.html

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (11)

M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more

Command & Control (4)

M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit

Actions on Objectives (14)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +9 more

Detection Coverage

27 strategies

7/7 stages covered

Reconnaissance (1)

DET0889 Detection of Network Security Appliances

Weaponization (2)

DET0838 Detection of Virtual Private Server DET0850 Detection of Obtain Capabilities

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0066 User Execution – Malicious Link (click →... DET0294 User Execution – Malicious File via down... DET0516 Behavioral Detection of Command and Scri...

Installation (6)

DET0034 Detection of Adversarial Process Discove... DET0097 Detection of Application Window Enumerat... DET0195 Behavioral Detection of System Network C... DET0370 Recursive Enumeration of Files and Direc... DET0392 Multi-Platform Software Discovery Behavi... +1 more

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0227 Detection Strategy for Non-Standard Port... DET0346 Detect Screen Capture via Commands and A... DET0457 Detection of Non-Application Layer Proto...

Actions on Objectives (9)

DET0127 Behavioral Detection of Masquerading Acr... DET0184 Behavioral Detection of Indicator Remova... DET0267 Resource Hijacking Detection Strategy DET0275 Detect Adversary Deobfuscation or Decodi... DET0299 Multi-Platform File and Directory Permis... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC5266

Type: Unknown Active

TAG-100 Storm-2077 UNC5291 UNC5221 APT28 +5 more

Infrastructure 26 IOC(s)

50%

Domain

360.net Mallory.ai gofile.io pan.xj.hk Gofile.io +6

IPv4 Address

205.185.124.24 34.85.128.214 209.141.57.116 107.189.8.240 205.185.126.208 +9

URL

http://login.offiec.us.kg/ms-help.html

Artifacts (14)

logd.spec.cfg 4f79c70cce4207d0ad57a339a9c7f43c e7d24813535f74187db31d4114f607a1 4acfc5df7f24c2354384f7449280d9e0 bb3b286f88728060c80ea65993576ef8 4645f2f6800bc654d5fa812237896b00 +8

Capability

50%

27 technique(s) 40 tool(s)/malware 10 CVE(s)

Agent Tesla Anatsa BLINDINGCAN BRICKSTORM BRICKSTORM malware BeaverTail CHINACHOPPER Carbon +32

collection

T1113

command and control

T1071.001 T1095 T1571

defense impairment

T1222 T1553

discovery

T1010 T1016 T1057 T1082 +2

Victim

70%

Targeted Sectors

government defense financial-services aerospace energy education legal-services transportation manufacturing media healthcare nuclear telecommunications utilities critical-infrastructure gaming non-profit

Targeted Countries

US CN TW KR GB JP KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1590.006

Capability (Malware)

Agent Tesla Anatsa BLINDINGCAN

Infrastructure

360.net Mallory.ai gofile.io

2 Weaponization

Capability (Techniques)

T1583.003 T1588

Capability (Malware)

Agent Tesla Anatsa BLINDINGCAN

Infrastructure

360.net Mallory.ai gofile.io

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Agent Tesla Anatsa BLINDINGCAN

Infrastructure

360.net Mallory.ai gofile.io

4 Exploitation

Capability (Techniques)

T1059 T1204.001 T1204.002

Capability (Malware)

Agent Tesla Anatsa BLINDINGCAN

Infrastructure

360.net Mallory.ai gofile.io

5 Installation

Capability (Techniques)

T1010 T1016 T1057 T1082 T1083

Capability (Malware)

Agent Tesla Anatsa BLINDINGCAN

Infrastructure

360.net Mallory.ai gofile.io

6 Command & Control

Capability (Techniques)

T1113 T1071.001 T1095 T1571

Capability (Malware)

Agent Tesla Anatsa BLINDINGCAN

Infrastructure

360.net Mallory.ai gofile.io

7 Actions on Objectives

Capability (Techniques)

T1496

Capability (Malware)

Agent Tesla Anatsa BLINDINGCAN

Infrastructure

360.net Mallory.ai gofile.io