Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Head Mare (threat actor)

Risk

Medium

0 techniques 40 tools/malware 24 vulnerabilities 39 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2009-3960

CVE CVE-2010-2861

CVE CVE-2018-13379

CVE CVE-2019-0604

CVE CVE-2019-3980

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-41352

CVE CVE-2023-23397

CVE CVE-2023-2868

CVE CVE-2023-32315

CVE CVE-2023-36802

CVE CVE-2023-42793

CVE CVE-2023-48788

CVE CVE-2024-1709

CVE CVE-2024-2617

CVE CVE-2025-0411

CVE CVE-2025-4427

CVE CVE-2025-4428

CVE CVE-2025-53690

CVE CVE-2025-53770

CVE CVE-2026-21509

CVE CVE-2026-21513

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

AnyDesk Babuk Backdoors Beacon Cobalt Cobalt Strike Cobalt Strike BEACON Custom tools DynoWiper FatalRat Global Handala Hydra Hydra Saiga J-magic LockBit Malware Merlin MuddyWater Mythic Payload Payload PhantomCore Phishing emails Polyglot PowerShell Remcos Rootkit Sagerunex SlowStepper Spear-phishing Spear-phishing emails Telegram Telegram bot Trojan Unknown Void Winnti Winrar phishing

Indicators of Compromise (39)

Domain

dog3rj.tech gouvn.me BI.ZONE note.youdao.com myqcloud.com crostech.ru thelightpower.info mail.gkrzn.ru +8 more

Email Address

ics-cert@kaspersky.com

Filename

MsMpSrv.exe pdf.lnk EndProcess.exe 19.01.26.zip 26.zip msiexec.exe v4.msi cmd.exe +14 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Head Mare

Type: Unknown Active

Fancy Bear APT28 port 1433 Mare Storm-2697 +35 more

Infrastructure 16 IOC(s)

50%

Domain

dog3rj.tech gouvn.me BI.ZONE note.youdao.com myqcloud.com +11

Artifacts (23)

ics-cert@kaspersky.com MsMpSrv.exe pdf.lnk EndProcess.exe 19.01.26.zip 26.zip +17

Capability

50%

40 tool(s)/malware 24 CVE(s)

AnyDesk Babuk Backdoors Beacon Cobalt Cobalt Strike Cobalt Strike BEACON Custom tools +32

Victim

70%

Targeted Sectors

government financial-services energy manufacturing transportation telecommunications defense education construction maritime aerospace critical-infrastructure retail healthcare pharmaceutical aviation oil-gas utilities chemical nuclear media mining entertainment legal-services

Targeted Countries

RU BY US UA AE PL BR IL KZ GB TW TR RO PK CN VN JP NG SA MX ES IT DE IN NL KR SG IR AU

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges