Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GhostR (threat actor)

Risk

Critical

10 techniques 40 tools/malware 9 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

CVE CVE-2022-38028

CVE CVE-2023-48022

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2026-26980

›

5 Installation

T1133

External Remote Services persistence

›

6 Command & Control

T1005

Data from Local System collection

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1048

Exfiltration Over Alternative Protocol exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

Stage risk: Critical High Medium None

Tools & Malware (40)

APT38 Akira Backdoors BianLian BlackCat BlackSuit Carbanak Clop Cobalt Cobalt Strike Conti Cring Custom malware Dark DarkSide Global Guard Hermit Jackal Kimsuky LockBit Malware Medusa MuddyWater Mythic Nexus OilRig Phishing campaigns Play PowerShell Ransomware variants Royal STOP Social engineering tactics Spear-phishing Trojan Volt Typhoon Wicked Winnti phishing

Indicators of Compromise (40)

Domain

Whotracks.Me TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex Hunt.io Huntresswindow.dataLayer +22 more

Filename

dynamic-body-Bs10dmXf.js chunk-LFPYN7LY-CAUjWit1.js root-BZqglhVp.js site-chrome-pz5fDnmH.js back-to-top-BSnHxjAC.js entry.client-BB3wyzmd.js dybKX07J.js asset.constants-ATRgSU9X.js +1 more

MD5 Hash

2ddea77933e345319f335529d35b6c1a

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (14)

M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (5)

M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program

Command & Control (3)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1057 Data Loss Prevention

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +5 more

Detection Coverage

10 strategies

5/7 stages covered

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Installation (1)

DET0354 Behavior-chain detection for T1133 Exter...

Command & Control (2)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (4)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft DET0548 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GhostR

Type: Unknown Active

other aliases several other aliases Jumpy Pisces ALPHV Gleaming Pisces +35 more

Infrastructure 30 IOC(s)

50%

Domain

Whotracks.Me TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope +25

Artifacts (10)

dynamic-body-Bs10dmXf.js chunk-LFPYN7LY-CAUjWit1.js root-BZqglhVp.js site-chrome-pz5fDnmH.js back-to-top-BSnHxjAC.js entry.client-BB3wyzmd.js +4

Capability

50%

10 technique(s) 40 tool(s)/malware 9 CVE(s)

APT38 Akira Backdoors BianLian BlackCat BlackSuit Carbanak Clop +32

collection

T1005

command and control

T1105

execution

T1059

exfiltration

T1048 T1567

Victim

70%

Targeted Sectors

government financial-services defense telecommunications healthcare critical-infrastructure education manufacturing energy media non-profit aerospace hospitality aviation transportation retail information-technology think-tank pharmaceutical maritime gaming legal-services chemical mining nuclear construction utilities entertainment oil-gas food-agriculture

Targeted Countries

CN US RU UA IR IN GB JP VN AU KR TW IL DE PL KP PK BY SG SA AE CA TR BR MX ES FR IT KZ RO NG LB AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566

Capability (Malware)

APT38 Akira Backdoors

Infrastructure

Whotracks.Me TEMP.Veles TEMP.Zagros

4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

APT38 Akira Backdoors

Infrastructure

Whotracks.Me TEMP.Veles TEMP.Zagros

5 Installation

Capability (Techniques)

T1133

Capability (Malware)

APT38 Akira Backdoors

Infrastructure

Whotracks.Me TEMP.Veles TEMP.Zagros

6 Command & Control

Capability (Techniques)

T1005 T1105

Capability (Malware)

APT38 Akira Backdoors

Infrastructure

Whotracks.Me TEMP.Veles TEMP.Zagros

7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

APT38 Akira Backdoors

Infrastructure

Whotracks.Me TEMP.Veles TEMP.Zagros