Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

LilacSquid (threat actor)

Risk

High

1 techniques 40 tools/malware 10 vulnerabilities 22 IOCs 2/7 stages covered Deepest: Command & Control

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2017-11882

CVE CVE-2022-22948

CVE CVE-2022-38028

CVE CVE-2022-41328

CVE CVE-2023-20867

CVE CVE-2023-34048

CVE CVE-2023-38831

CVE CVE-2024-27878

CVE CVE-2024-32113

CVE CVE-2024-7029

›

5 Installation

No data

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

AutoIt Backdoors CHINACHOPPER Clop Cobalt Cobalt Strike Custom malware DarkGate DarkGate malware Dora RAT GitHub Hafnium Kapeka Kimsuky MESHAGENT Malware Moonstone Sleet MuddyWater Nexus Open-source tools Payload Payload PhantomCore PhantomDL Phishing emails PowerShell Qilin Qilin Ransomware QuasarRAT SMALLTIGER Secure Socket Funneling SentinelOne Spear-phishing TargetCompany Telegram Trojan UAT-7290 Unknown phishing purpleink

Indicators of Compromise (22)

Domain

demo-cloud.space cisa.gov advanced-ip-sccanner.com DataBreaches.net Snort.org cryptonator.com hunter.io snov.io +5 more

Email Address

ics-cert@kaspersky.com

Filename

Complaint.doc msimg32.dll cmd.exe

SHA-256 Hash

2eb9c6722139e821c2fe8314b356880be70f3d19d8d2ba530adc9f466ffc67d8

IPv4 Address

199.229.250.142 67.213.221.6 192.145.127.190 45.9.251.14

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

2 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Detection Coverage

1 strategies

1/7 stages covered

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

LilacSquid

Type: Unknown Active

Onyx Sleet Fancy Bear Europe Asia TeaBot +30 more

Infrastructure 17 IOC(s)

50%

Domain

demo-cloud.space cisa.gov advanced-ip-sccanner.com DataBreaches.net Snort.org +8

IPv4 Address

199.229.250.142 67.213.221.6 192.145.127.190 45.9.251.14

Artifacts (5)

ics-cert@kaspersky.com Complaint.doc msimg32.dll cmd.exe 2eb9c6722139e821c2fe8314b356880be70f3d19d8d2ba530adc9f466ffc67d8

Capability

50%

1 technique(s) 40 tool(s)/malware 10 CVE(s)

AutoIt Backdoors CHINACHOPPER Clop Cobalt Cobalt Strike Custom malware DarkGate +32

command and control

T1105

Victim

70%

Targeted Sectors

financial-services government telecommunications defense manufacturing pharmaceutical education critical-infrastructure transportation aerospace energy construction information-technology maritime aviation healthcare retail hospitality utilities mining nuclear oil-gas gaming legal-services

Targeted Countries

US RU UA CN KR IN TW IL TR EG IT BY PL

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

AutoIt Backdoors CHINACHOPPER

Infrastructure

demo-cloud.space cisa.gov advanced-ip-sccanner.com