Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Bondnet (threat actor)

Risk

Medium

0 techniques 40 tools/malware 1 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

BLINDINGCAN Backdoor malware Backdoors Buhtrap Carbon Cobalt DEADEYE Dark DarkHotel Emotet GitHub Global Guard Hellsing Hidden Cobra Jackal Malware Malwarebytes Matrix Mirage Naikon Nexus Nitro PLAY Poseidon Predator Rootkit Samurai Shamoon Shark Spear-phishing TeamSpy Trojan Tsunami Turla Unknown VICEROY Void gcman phishing

Indicators of Compromise (40)

Domain

absdata.txt TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +31 more

Email Address

kristinpersson@berkeley.edu

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Bondnet

Type: Unknown Active

root access a botnet cpyy APT3 Gothic Panda +13 more

Infrastructure 39 IOC(s)

50%

Domain

absdata.txt TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +34

Artifacts (1)

kristinpersson@berkeley.edu

Capability

50%

40 tool(s)/malware 1 CVE(s)

BLINDINGCAN Backdoor malware Backdoors Buhtrap Carbon Cobalt DEADEYE Dark +32

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy aerospace media education manufacturing mining information-technology maritime think-tank healthcare pharmaceutical chemical transportation food-agriculture hospitality legal-services nuclear entertainment

Targeted Countries

US CN GB IN JP DE KR IR SA RU TW IL FR CA TR AU KZ PK VN UA PL AE SG NL BR ES IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges