Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-1849 (threat actor)

Risk

Critical

29 techniques 40 tools/malware 17 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1587

Develop Capabilities resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

CVE CVE-2018-0101

CVE CVE-2022-23093

CVE CVE-2022-38028

CVE CVE-2023-47246

CVE CVE-2023-48022

CVE CVE-2024-20353

CVE CVE-2024-20359

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2025-20363

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2026-20182

›

5 Installation

T1040

Network Sniffing credential access

T1557

Adversary-in-the-Middle credential access

T1082

System Information Discovery discovery

T1037

Boot or Logon Initialization Scripts persistence

T1133

External Remote Services persistence

T1653

Power Settings persistence

›

6 Command & Control

T1119

Automated Collection collection

T1071

Application Layer Protocol command and control

T1102

Web Service command and control

›

7 Actions on Objectives

T1556

Modify Authentication Process defense impairment

T1685

Disable or Modify Tools defense impairment

T1690

Prevent Command History Logging defense impairment

T1020

Automated Exfiltration exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1048

Exfiltration Over Alternative Protocol exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

T1014

Rootkit stealth

T1036

Masquerading stealth

T1055

Process Injection stealth

T1070

Indicator Removal stealth

T1140

Deobfuscate/Decode Files or Information stealth

T0874

T1562

Stage risk: Critical High Medium None

Tools & Malware (40)

AvosLocker Backdoors BlackSuit Cobalt Cobalt Strike Conti Custom backdoors Custom malware Dark FrostyGoop FunnyDream Global Hook Interception J-magic Leverage Line Dancer Line Runner LockBit Lynx Malware Mythic Nexus OilRig Payload Payload Pikabot PlugX PowerShell Quad7 Royal Royal Ransomware STOP SolarWinds ToolShell Triton Unknown Volt Typhoon Zscaler phishing

Indicators of Compromise (40)

Domain

Snort.org umtfc.txt stgvdr.txt laecsnw.txt hash.txt index.ini index.txt

Email Address

psirt@cisco.com

MD5 Hash

1515480F4B538B669648B17C02337098

SHA-1 Hash

0000000000000000000000000000000000000002

IPv4 Address

45.77.52.253 103.114.200.230 212.193.2.48 51.15.145.37 89.44.198.196 131.196.252.148 213.156.138.78 121.227.168.69 +22 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

32 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (13)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +8 more

Command & Control (5)

M1021 Restrict Web-Based Content M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information

Actions on Objectives (25)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +20 more

Detection Coverage

27 strategies

6/7 stages covered

Weaponization (2)

DET0853 Detection of Develop Capabilities DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Installation (6)

DET0112 Boot or Logon Initialization Scripts Det... DET0296 Detect Adversary-in-the-Middle via Netwo... DET0314 Detection Strategy for Network Sniffing... DET0354 Behavior-chain detection for T1133 Exter... DET0417 Detection Strategy for Power Settings Ab... +1 more

Command & Control (3)

DET0186 Automated File and API Collection Detect... DET0425 Suspicious Use of Web Services for C2 DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (14)

DET0104 Detect Modification of Authentication Pr... DET0127 Behavioral Detection of Masquerading Acr... DET0131 Behavioral Detection Strategy for Exfilt... DET0184 Behavioral Detection of Indicator Remova... DET0215 Detection of Multi-Platform File Encrypt... +9 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-1849

Type: Unknown Active

UAT4356 UAT4356 by Talos CVE-2025-20333 CVE-2025-20362 CVE-2025-20363 +12 more

Infrastructure 37 IOC(s)

50%

Domain

Snort.org umtfc.txt stgvdr.txt laecsnw.txt hash.txt +2

IPv4 Address

45.77.52.253 103.114.200.230 212.193.2.48 51.15.145.37 89.44.198.196 +25

Artifacts (3)

psirt@cisco.com 1515480F4B538B669648B17C02337098 0000000000000000000000000000000000000002

Capability

50%

29 technique(s) 40 tool(s)/malware 17 CVE(s)

AvosLocker Backdoors BlackSuit Cobalt Cobalt Strike Conti Custom backdoors Custom malware +32

T0874 T1562

collection

T1119

command and control

T1071 T1102

credential access

T1040 T1557

Victim

70%

Targeted Sectors

government financial-services energy telecommunications defense healthcare critical-infrastructure education manufacturing maritime aviation transportation information-technology media hospitality non-profit aerospace construction retail chemical think-tank nuclear oil-gas legal-services entertainment gaming food-agriculture

Targeted Countries

CN UA US IN GB RU JP AU IR DE PL CA TW KR SG VN KP KZ IL TR FR BR MX ES IT PK BY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1587

Capability (Malware)

AvosLocker Backdoors BlackSuit

Infrastructure

Snort.org umtfc.txt stgvdr.txt

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

AvosLocker Backdoors BlackSuit

Infrastructure

Snort.org umtfc.txt stgvdr.txt

4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

AvosLocker Backdoors BlackSuit

Infrastructure

Snort.org umtfc.txt stgvdr.txt

5 Installation

Capability (Techniques)

T1040 T1557 T1082 T1037 T1133

Capability (Malware)

AvosLocker Backdoors BlackSuit

Infrastructure

Snort.org umtfc.txt stgvdr.txt

6 Command & Control

Capability (Techniques)

T1119 T1071 T1102

Capability (Malware)

AvosLocker Backdoors BlackSuit

Infrastructure

Snort.org umtfc.txt stgvdr.txt

7 Actions on Objectives

Capability (Techniques)

T1020 T1041 T1048 T1567 T1486

Capability (Malware)

AvosLocker Backdoors BlackSuit

Infrastructure

Snort.org umtfc.txt stgvdr.txt