Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ArcaneDoor (threat actor)

Risk

Critical

26 techniques 31 tools/malware 7 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1587

Develop Capabilities resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

CVE CVE-2018-0101

CVE CVE-2024-20353

CVE CVE-2024-20359

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2025-20363

CVE CVE-2026-20182

›

5 Installation

T1040

Network Sniffing credential access

T1557

Adversary-in-the-Middle credential access

T1082

System Information Discovery discovery

T1037

Boot or Logon Initialization Scripts persistence

T1133

External Remote Services persistence

T1653

Power Settings persistence

›

6 Command & Control

T1119

Automated Collection collection

T1071

Application Layer Protocol command and control

T1102

Web Service command and control

T1102.003

One-Way Communication command and control

›

7 Actions on Objectives

T1556

Modify Authentication Process defense impairment

T1685

Disable or Modify Tools defense impairment

T1690

Prevent Command History Logging defense impairment

T1020

Automated Exfiltration exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1014

Rootkit stealth

T1036

Masquerading stealth

T1055

Process Injection stealth

T1070

Indicator Removal stealth

T1140

Deobfuscate/Decode Files or Information stealth

T0874

T1562

Stage risk: Critical High Medium None

Tools & Malware (31)

Backdoors Custom backdoors Custom malware Device code phishing EvilTokens Expand GitHub Global Hafnium Hook Interception Leverage Line Dancer Line Runner Malware Matrix Payload Payload Resident Rootkit Rustonotto STOP SentinelOne Singularity Unknown Web Shell Web Shells Webshell Zscaler phishing route

Indicators of Compromise (40)

Domain

Snort.org umtfc.txt stgvdr.txt laecsnw.txt hash.txt index.ini index.txt

Email Address

psirt@cisco.com

MD5 Hash

1515480F4B538B669648B17C02337098

SHA-1 Hash

0000000000000000000000000000000000000002

IPv4 Address

45.77.52.253 103.114.200.230 212.193.2.48 51.15.145.37 89.44.198.196 131.196.252.148 213.156.138.78 121.227.168.69 +22 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

31 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (13)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +8 more

Command & Control (5)

M1021 Restrict Web-Based Content M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information

Actions on Objectives (21)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1025 Privileged Process Integrity +16 more

Detection Coverage

24 strategies

6/7 stages covered

Weaponization (2)

DET0853 Detection of Develop Capabilities DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Installation (6)

DET0112 Boot or Logon Initialization Scripts Det... DET0296 Detect Adversary-in-the-Middle via Netwo... DET0314 Detection Strategy for Network Sniffing... DET0354 Behavior-chain detection for T1133 Exter... DET0417 Detection Strategy for Power Settings Ab... +1 more

Command & Control (4)

DET0186 Automated File and API Collection Detect... DET0425 Suspicious Use of Web Services for C2 DET0444 Detection of Command and Control Over Ap... DET0581 Detect One-Way Web Service Command Chann...

Actions on Objectives (10)

DET0104 Detect Modification of Authentication Pr... DET0127 Behavioral Detection of Masquerading Acr... DET0184 Behavioral Detection of Indicator Remova... DET0275 Detect Adversary Deobfuscation or Decodi... DET0348 Detection Strategy for Exfiltration Over... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ArcaneDoor

Type: Unknown Active

UAT4356 by Talos

Infrastructure 37 IOC(s)

50%

Domain

Snort.org umtfc.txt stgvdr.txt laecsnw.txt hash.txt +2

IPv4 Address

45.77.52.253 103.114.200.230 212.193.2.48 51.15.145.37 89.44.198.196 +25

Artifacts (3)

psirt@cisco.com 1515480F4B538B669648B17C02337098 0000000000000000000000000000000000000002

Capability

50%

26 technique(s) 31 tool(s)/malware 7 CVE(s)

Backdoors Custom backdoors Custom malware Device code phishing EvilTokens Expand GitHub Global +23

T0874 T1562

collection

T1119

command and control

T1071 T1102 T1102.003

credential access

T1040 T1557

Victim

70%

Targeted Sectors

government energy aviation healthcare maritime defense telecommunications critical-infrastructure

Targeted Countries

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1587

Capability (Malware)

Backdoors Custom backdoors Custom malware

Infrastructure

Snort.org umtfc.txt stgvdr.txt

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Backdoors Custom backdoors Custom malware

Infrastructure

Snort.org umtfc.txt stgvdr.txt

4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

Backdoors Custom backdoors Custom malware

Infrastructure

Snort.org umtfc.txt stgvdr.txt

5 Installation

Capability (Techniques)

T1040 T1557 T1082 T1037 T1133

Capability (Malware)

Backdoors Custom backdoors Custom malware

Infrastructure

Snort.org umtfc.txt stgvdr.txt

6 Command & Control

Capability (Techniques)

T1119 T1071 T1102 T1102.003

Capability (Malware)

Backdoors Custom backdoors Custom malware

Infrastructure

Snort.org umtfc.txt stgvdr.txt

7 Actions on Objectives

Capability (Techniques)

T1020 T1041

Capability (Malware)

Backdoors Custom backdoors Custom malware

Infrastructure

Snort.org umtfc.txt stgvdr.txt