Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Unfading Sea Haze (threat actor)

Risk

Medium

0 techniques 40 tools/malware 4 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2022-0543

CVE CVE-2023-46805

CVE CVE-2024-21887

CVE CVE-2025-22457

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Beacon C2 infrastructure CLAIMLOADER Crimson Custom malware Explorer Gh0st GitHub Google Drive HIUPAN Havoc InsidiousGh0st LNK files Legitimate Software MAILCREEP MASOL MASOL RAT MSBuild Malware Nexus OneDrive PUBLOAD Payload Payload PowerShell PowerShell code SHEETCREEP Scheduled Tasks SilentGh0st Spear-phishing Telegram Unknown Web Shells WildFire cmd.exe curl gh0st RAT msbuild.exe phishing powershell.exe

Indicators of Compromise (40)

Domain

laichingte.net webmail.rpcthai.com Microsoft.NET loader.ja Cookies.dat curs.cur

Filename

mscorsvc.dll MSBuild.exe kernel32.dll Hid.dll ekrn.exe bdusersy.dll EVENT.dll seccenter.exe +14 more

SHA-256 Hash

34bf325492614dd4d842ec24f22a402ab73908cb91a74846945eae4775290ff2 f07b2af21e3fab6af5166a44ca77ed0ebc7c9a3e623202a63d4c4492abce8d65 4b29b74798a4e6538f2ba245c57be82953383dc91fe0a91b984b903d12043e92 835795aa494021752f21fbef63c81227c1b934437a02aa1f2a258c9f60b0b7a3 851d57a2bf514202f54dafa1eb83a862653be7512b6e9535914b8d1d719d495f 84e37e42312b9a502c40cf1f3fc181e3ebd4f3e35c58bbf182740dfe38d3b6b9 11c7728697d5ea11c592fee213063c6369340051157f71ddc7ca891f5f367720 1aa37a477c539edf25656a300002a28d4246ec83344422dd705b42d3443a2623 +2 more

IPv4 Address

159.223.78.147 154.90.34.83

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Unfading Sea Haze

Type: Unknown Active

UNC5221 Transparent Tribe CVE-2022-0543 HIUPAN EggStreme Agent +2 more

Infrastructure 8 IOC(s)

50%

Domain

laichingte.net webmail.rpcthai.com Microsoft.NET loader.ja Cookies.dat +1

IPv4 Address

159.223.78.147 154.90.34.83

Artifacts (32)

mscorsvc.dll MSBuild.exe kernel32.dll Hid.dll ekrn.exe bdusersy.dll +26

Capability

50%

40 tool(s)/malware 4 CVE(s)

Beacon C2 infrastructure CLAIMLOADER Crimson Custom malware Explorer Gh0st GitHub +32

Victim

70%

Targeted Sectors

government defense manufacturing

Targeted Countries

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges