Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC5337 (threat actor)

Risk

Critical

18 techniques 40 tools/malware 35 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059.004

Unix Shell execution

CVE CVE-2018-0171

CVE CVE-2019-11539

CVE CVE-2020-8218

CVE CVE-2023-33538

CVE CVE-2023-46805

CVE CVE-2024-21887

CVE CVE-2024-21893

CVE CVE-2025-0282

CVE CVE-2025-0283

CVE CVE-2025-0921

CVE CVE-2025-22457

CVE CVE-2025-24813

CVE CVE-2025-34291

CVE CVE-2025-40947

CVE CVE-2025-40948

CVE CVE-2026-0257

CVE CVE-2026-0300

CVE CVE-2026-12569

CVE CVE-2026-1281

CVE CVE-2026-1340

CVE CVE-2026-15409

CVE CVE-2026-15410

CVE CVE-2026-1731

CVE CVE-2026-18577

CVE CVE-2026-20079

CVE CVE-2026-20316

CVE CVE-2026-31431

CVE CVE-2026-33825

CVE CVE-2026-35273

CVE CVE-2026-39987

CVE CVE-2026-5281

CVE CVE-2026-63077

CVE CVE-2026-64600

CVE CVE-2026-6875

CVE CVE-2026-9198

›

5 Installation

T1018

Remote System Discovery discovery

T1046

Network Service Discovery discovery

T1133

External Remote Services persistence

T1505.003

Web Shell persistence

›

6 Command & Control

T1572

Protocol Tunneling command and control

T1021.001

Remote Desktop Protocol lateral movement

T1021.002

SMB/Windows Admin Shares lateral movement

›

7 Actions on Objectives

T1556

Modify Authentication Process defense impairment

T1020

Automated Exfiltration exfiltration

T1070

Indicator Removal stealth

T1070.003

Clear Command History stealth

T1070.004

File Deletion stealth

T1070.001

T1070.002

T1562.001

Stage risk: Critical High Medium None

Tools & Malware (40)

BPFDoor BRICKSTORM BRICKSTORM backdoor BRICKSTORM malware CL0P CrackMapExec Custom malware DRYHOOK Dark GOST GitHub Gorilla Havex RAT INC Ransomware Infostealer Infostealer malware Kubernetes Langflow Leverage MSBuild Malware Nexus OilRig PHASEJAM Payload PowerShell Qilin SLIVER Implant SPAWNANT SPAWNMOLE Scheduled Tasks Sliver TONERJAM Volt Typhoon WARPWIRE WARPWIRE Variant Web Shell WildFire msbuild.exe phishing

Indicators of Compromise (40)

Domain

cron.sh restAuth.cgi libupgrade.so libsocks5.so libsshd.so setcookie.thmtl.ttc pan.xj.hk ldap.pl +17 more

Filename

package.dll vixDiskLib.dll deelevator64.dll MSBuild.exe DeElevate64.exe cmd.exe msbuild.lnk

MD5 Hash

9d684815bc96508b99e6302e253bc292 4f79c70cce4207d0ad57a339a9c7f43c e7d24813535f74187db31d4114f607a1 4acfc5df7f24c2354384f7449280d9e0 bb3b286f88728060c80ea65993576ef8 4645f2f6800bc654d5fa812237896b00

IPv4 Address

193.149.180.128 168.100.8.144

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (1)

M1038 Execution Prevention

Installation (7)

M1018 User Account Management M1021 Restrict Web-Based Content M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +2 more

Command & Control (11)

M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation +6 more

Actions on Objectives (12)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1025 Privileged Process Integrity M1026 Privileged Account Management +7 more

Detection Coverage

15 strategies

6/7 stages covered

Reconnaissance (1)

DET0867 Detection of Vulnerability Scanning

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0384 Behavioral Detection of Unix Shell Execu...

Installation (4)

DET0354 Behavior-chain detection for T1133 Exter... DET0376 Behavioral Detection Strategy for Networ... DET0394 Web Shell Detection via Server Behavior... DET0574 Detection Strategy for Remote System Enu...

Command & Control (3)

DET0327 Multi-event Detection Strategy for RDP-B... DET0530 Multi-Event Detection for SMB Admin Shar... DET0538 Detection Strategy for Protocol Tunnelin...

Actions on Objectives (5)

DET0104 Detect Modification of Authentication Pr... DET0140 Behavioral Detection of Malicious File D... DET0165 Behavioral Detection of Command History... DET0184 Behavioral Detection of Indicator Remova... DET0397 Automated Exfiltration Detection Strateg...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC5337

Type: Unknown Active

CVE-2025-0282 UNC5291 targeting U.S IF-T SnowSight

Infrastructure 27 IOC(s)

50%

Domain

cron.sh restAuth.cgi libupgrade.so libsocks5.so libsshd.so +20

IPv4 Address

193.149.180.128 168.100.8.144

Artifacts (13)

package.dll vixDiskLib.dll deelevator64.dll MSBuild.exe DeElevate64.exe cmd.exe +7

Capability

50%

18 technique(s) 40 tool(s)/malware 35 CVE(s)

BPFDoor BRICKSTORM BRICKSTORM backdoor BRICKSTORM malware CL0P CrackMapExec Custom malware DRYHOOK +32

T1070.001 T1070.002 T1562.001

command and control

T1572

defense impairment

T1556

discovery

T1018 T1046

Victim

70%

Targeted Sectors

financial-services healthcare government critical-infrastructure manufacturing defense education hospitality energy gaming telecommunications

Targeted Countries

CN GB IR FR JP RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.002

Capability (Malware)

BPFDoor BRICKSTORM BRICKSTORM backdoor

Infrastructure

cron.sh restAuth.cgi libupgrade.so

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

BPFDoor BRICKSTORM BRICKSTORM backdoor

Infrastructure

cron.sh restAuth.cgi libupgrade.so

4 Exploitation

Capability (Techniques)

T1059.004

Capability (Malware)

BPFDoor BRICKSTORM BRICKSTORM backdoor

Infrastructure

cron.sh restAuth.cgi libupgrade.so

5 Installation

Capability (Techniques)

T1018 T1046 T1133 T1505.003

Capability (Malware)

BPFDoor BRICKSTORM BRICKSTORM backdoor

Infrastructure

cron.sh restAuth.cgi libupgrade.so

6 Command & Control

Capability (Techniques)

T1572 T1021.001 T1021.002

Capability (Malware)

BPFDoor BRICKSTORM BRICKSTORM backdoor

Infrastructure

cron.sh restAuth.cgi libupgrade.so

7 Actions on Objectives

Capability (Techniques)

T1020

Capability (Malware)

BPFDoor BRICKSTORM BRICKSTORM backdoor

Infrastructure

cron.sh restAuth.cgi libupgrade.so