Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UTA0218 (threat actor)

Risk

High

3 techniques 40 tools/malware 6 vulnerabilities 30 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2014-6352

CVE CVE-2022-42475

CVE CVE-2024-3400

CVE CVE-2026-0257

CVE CVE-2026-0300

CVE CVE-2026-31431

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1542

Pre-OS Boot stealth

T5000

T9000

Stage risk: Critical High Medium None

Tools & Malware (40)

AcidRain Akira Akira ransomware Backdoor malware Backdoors BeaverTail BlackByte Cobalt Cobalt Strike Conti Custom Backdoor Exaramel GitHub Global HiddenFace Kimsuky LockBit Malware Medusa Mimikatz Mobile malware MuddyWater Naikon OilRig Payload Payload Play PlugX PowerShell PowerShell Backdoor Rootkit Shai-Hulud Shamoon SolarWinds TrickBot Trojan Turla UPSTYLE phishing web shell

Indicators of Compromise (30)

Domain

DIG.net get-content-issue-msg.sh

Filename

Node.js enterprise-attack-v17.1-software.xlsx netsh.exe net.exe mscorsvc.dll cipher.exe PACLOUD.exe schtasks.exe +19 more

IPv4 Address

172.233.228.93

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

5 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Actions on Objectives (5)

M1026 Privileged Account Management M1035 Limit Access to Resource Over Network M1046 Boot Integrity M1047 Audit M1051 Update Software

Detection Coverage

1 strategies

1/7 stages covered

Actions on Objectives (1)

DET0278 Detection Strategy for T1542 Pre-OS Boot

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UTA0218

Type: Unknown Active

Project Spy Cridex U2DiskWatch similar to Sliver Cobalt Strike +5 more

Infrastructure 3 IOC(s)

50%

Domain

DIG.net get-content-issue-msg.sh

IPv4 Address

172.233.228.93

Artifacts (27)

Node.js enterprise-attack-v17.1-software.xlsx netsh.exe net.exe mscorsvc.dll cipher.exe +21

Capability

50%

3 technique(s) 40 tool(s)/malware 6 CVE(s)

AcidRain Akira Akira ransomware Backdoor malware Backdoors BeaverTail BlackByte Cobalt +32

T5000 T9000

stealth

T1542

Victim

70%

Targeted Sectors

financial-services government defense telecommunications manufacturing education healthcare critical-infrastructure energy transportation media information-technology retail aerospace mining pharmaceutical aviation maritime chemical legal-services nuclear hospitality gaming

Targeted Countries

US RU UA BR CN KR AU GB IN PL MX ES CA JP DE IL TR SY TW IT SA IR FR VN SG AE NL AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges