Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Dragonfly (threat actor)

Risk

Critical

58 techniques 60 tools/malware 8 vulnerabilities 8 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1591.002

Business Relationships reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

T1598.002

Spearphishing Attachment reconnaissance

T1598.003

Spearphishing Link reconnaissance

›

2 Weaponization

T1583.001

Domains resource development

T1583.003

Virtual Private Server resource development

T1584.004

Server resource development

T1588.002

Tool resource development

T1608.004

Drive-by Target resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

T1195.002

Compromise Software Supply Chain initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.006

Python execution

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

CVE CVE-2022-38028

CVE CVE-2023-48022

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

›

5 Installation

T1003.002

Security Account Manager credential access

T1003.003

NTDS credential access

T1003.004

LSA Secrets credential access

T1110

Brute Force credential access

T1110.002

Password Cracking credential access

T1187

Forced Authentication credential access

T1012

Query Registry discovery

T1016

System Network Configuration Discovery discovery

T1018

Remote System Discovery discovery

T1033

System Owner/User Discovery discovery

T1069.002

Domain Groups discovery

T1083

File and Directory Discovery discovery

T1087.002

Domain Account discovery

T1135

Network Share Discovery discovery

T1098.007

Additional Local or Domain Groups persistence

T1133

External Remote Services persistence

T1136.001

Local Account persistence

T1505.003

Web Shell persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1005

Data from Local System collection

T1074.001

Local Data Staging collection

T1113

Screen Capture collection

T1114.002

Remote Email Collection collection

T1560

Archive Collected Data collection

T1071.002

File Transfer Protocols command and control

T1105

Ingress Tool Transfer command and control

T1021.001

Remote Desktop Protocol lateral movement

T1210

Exploitation of Remote Services lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1685.005

Clear Windows Event Logs defense impairment

T1686

Disable or Modify System Firewall defense impairment

T1036.010

Masquerade Account Name stealth

T1070.004

File Deletion stealth

T1078

Valid Accounts stealth

T1221

Template Injection stealth

T1564.002

Hidden Users stealth

T0817

T0862

Stage risk: Critical High Medium None

Tools & Malware (60)

AvosLocker Babuk Backdoor.Oldrea Backdoors Bad Rabbit Cheerscrypt Cobalt Cobalt Strike Commix Conti Crisis Custom malware Dirsearch Exploit Kit Explorer FrostyGoop FunnyDream Global Globe HAVEX RAT Havex RAT Hello exploit kit Impacket Industroyer Inveigh J-magic Karagany Kraken Leverage LightsOut ExploitKit MCMD Matrix Nexus Nmap OilRig Oldrea Open source tools PHPMailer Persistence through .LNK file manipulations Phishing emails Pikabot PlugX PsExec Python scripts SMBTrap Solar SolarWinds Spear-phishing Spear-phishing emails Subbrute Sublist3r TeamSpy Triton Trojan Trojan.Karagany Unknown Web Shells Wpscan phishing sqlmap

Indicators of Compromise (8)

Domain

cyber-kill-chain.ch Backdoor.Oldrea Trojan.Karagany TEMP.Isotope SEC.gov TEMP.Veles Scythe.io

Filename

scr.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (3)

M1017 User Training M1054 Software Configuration M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (15)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +10 more

Installation (13)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies +8 more

Command & Control (18)

M1016 Vulnerability Scanning M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1028 Operating System Configuration +13 more

Actions on Objectives (17)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +12 more

Detection Coverage

56 strategies

7/7 stages covered

Reconnaissance (4)

DET0855 Detection of Business Relationships DET0865 Detection of Spearphishing Attachment DET0867 Detection of Vulnerability Scanning DET0878 Detection of Spearphishing Link

Weaponization (5)

DET0825 Detection of Drive-by Target DET0838 Detection of Virtual Private Server DET0852 Detection of Tool DET0874 Detection of Server DET0892 Detection of Domains

Delivery (4)

DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... DET0309 Compromised software/update chain (insta...

Exploitation (7)

DET0063 Cross-Platform Behavioral Detection of P... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0441 Detection of Suspicious Scheduled Task C... +2 more

Installation (19)

DET0022 Detect Forced SMB/WebDAV Authentication... DET0085 Credential Dumping from SAM via Registry... DET0093 Behavioral Detection of User Discovery v... DET0105 Post-Credential Dump Password Cracking D... DET0129 Domain Account Enumeration Across Platfo... +14 more

Command & Control (9)

DET0048 Detect Remote Email Collection via Abnor... DET0060 Detect Ingress Tool Transfers via Behavi... DET0118 Exploitation of Remote Services – multi-... DET0261 Detection of Local Data Staging Prior to... DET0327 Multi-event Detection Strategy for RDP-B... +4 more

Actions on Objectives (8)

DET0140 Behavioral Detection of Malicious File D... DET0145 Detection of Disabled or Modified System... DET0280 Behavior-Based Registry Modification Det... DET0353 Detection Strategy for Hidden User Accou... DET0383 Detection Strategy for Masquerading via... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Dragonfly

Type: Unknown Active

TEMP.Isotope DYMALLOY Berserk Bear TG-4192 Crouching Yeti +32 more

Infrastructure 7 IOC(s)

50%

Domain

cyber-kill-chain.ch Backdoor.Oldrea Trojan.Karagany TEMP.Isotope SEC.gov +2

Artifacts (1)

scr.exe

Capability

89%

58 technique(s) 60 tool(s)/malware 8 CVE(s)

AvosLocker Babuk Backdoor.Oldrea Backdoors Bad Rabbit Cheerscrypt Cobalt Cobalt Strike +52

T0817 T0862

collection

T1005 T1074.001 T1113 T1114.002 +1

command and control

T1071.002 T1105

credential access

T1003.002 T1003.003 T1003.004 T1110 +2

Victim

70%

Targeted Sectors

energy technology education critical infrastructure defense healthcare government manufacturing critical-infrastructure financial-services aviation telecommunications pharmaceutical transportation oil-gas nuclear construction information-technology chemical maritime think-tank aerospace utilities media hospitality non-profit legal-services

Targeted Countries

middle_east europe US UA CN GB IN JP CA RU AU KR PL SG VN TW IR DE KZ IL TR FR BR MX ES IT

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1591.002 T1595.002 T1598.002 T1598.003

Capability (Malware)

AvosLocker Babuk Backdoor.Oldrea

Infrastructure

cyber-kill-chain.ch Backdoor.Oldrea Trojan.Karagany

2 Weaponization

Capability (Techniques)

T1583.001 T1583.003 T1584.004 T1588.002 T1608.004

Capability (Malware)

AvosLocker Babuk Backdoor.Oldrea

Infrastructure

cyber-kill-chain.ch Backdoor.Oldrea Trojan.Karagany

3 Delivery

Capability (Techniques)

T1189 T1190 T1195.002 T1566.001

Capability (Malware)

AvosLocker Babuk Backdoor.Oldrea

Infrastructure

cyber-kill-chain.ch Backdoor.Oldrea Trojan.Karagany

4 Exploitation

Capability (Techniques)

T1053.005 T1059 T1059.001 T1059.003 T1059.006

Capability (Malware)

AvosLocker Babuk Backdoor.Oldrea

Infrastructure

cyber-kill-chain.ch Backdoor.Oldrea Trojan.Karagany

5 Installation

Capability (Techniques)

T1003.002 T1003.003 T1003.004 T1110 T1110.002

Capability (Malware)

AvosLocker Babuk Backdoor.Oldrea

Infrastructure

cyber-kill-chain.ch Backdoor.Oldrea Trojan.Karagany

6 Command & Control

Capability (Techniques)

T1005 T1074.001 T1113 T1114.002 T1560

Capability (Malware)

AvosLocker Babuk Backdoor.Oldrea

Infrastructure

cyber-kill-chain.ch Backdoor.Oldrea Trojan.Karagany