Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

StucxTeam (threat actor)

Risk

Medium

0 techniques 40 tools/malware 1 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Agent Tesla Anchor BLINDINGCAN Buhtrap Cobalt DEADEYE Dark DarkHotel DieNet Explorer Ghost RAT Global Hellsing Hidden Cobra Jackal Lynx Malware Matrix Mimikatz Mirage Mythic Naikon Nexus Nitro PittyTiger Poseidon Predator Samurai Shamoon Shark Spear-phishing TeamSpy Telegram Trojan Tsunami Turla VICEROY Void gcman phishing

Indicators of Compromise (40)

Domain

demo-cloud.space cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao +32 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

StucxTeam

Type: Unknown Active

BokBot Russian Cyber Army Team Ukraine began cpyy APT3 +14 more

Infrastructure 40 IOC(s)

50%

Domain

demo-cloud.space cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad +35

Capability

50%

40 tool(s)/malware 1 CVE(s)

Agent Tesla Anchor BLINDINGCAN Buhtrap Cobalt DEADEYE Dark DarkHotel +32

Victim

70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications media aerospace education healthcare manufacturing information-technology maritime think-tank critical-infrastructure pharmaceutical chemical mining utilities hospitality legal-services nuclear entertainment aviation

Targeted Countries

US CN BR IL GB IN JP DE KR RU FR IR SA TW CA TR UA PL AU KZ PK AE VN ES SG NL IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges