Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

SneakyChef (threat actor)

Risk

High

1 techniques 40 tools/malware 24 vulnerabilities 40 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2013-3893

CVE CVE-2014-0322

CVE CVE-2014-1776

CVE CVE-2014-4114

CVE CVE-2015-2545

CVE CVE-2015-5119

CVE CVE-2015-5122

CVE CVE-2017-11882

CVE CVE-2017-8759

CVE CVE-2018-0798

CVE CVE-2018-8174

CVE CVE-2019-13720

CVE CVE-2019-2215

CVE CVE-2021-1675

CVE CVE-2021-28310

CVE CVE-2021-34527

CVE CVE-2021-35211

CVE CVE-2023-23397

CVE CVE-2023-38831

CVE CVE-2024-21412

CVE CVE-2024-4577

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2104-4114

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T9000

Stage risk: Critical High Medium None

Tools & Malware (40)

Aurora Backdoors BlackEnergy Cobalt Cobalt Strike Confucius Dark Dridex Emotet Gh0st GitHub Global Kimsuky Malware Malwarebytes MiniDuke MuddyWater OceanLotus OilRig PlugX Poison Ivy PowerShell QakBot Regin Rootkit Sednit SentinelOne ShadowPad Shamoon SideWinder Sofacy Taidoor Trojan Turla Unknown Winnti Zebrocy Zscaler gh0st RAT phishing

Indicators of Compromise (40)

Domain

cisa.gov TEMP.Periscope W32.Stuxnet OSX.WindTail Dr.Web CERT.NGO SEKOIA.IO Backdoor.Winnti +23 more

Filename

update.dll regsvr32.exe

SHA-256 Hash

8db5a7efe1a83e43cb4acdc596b0413b4beb54f9f8e13f978c07a6eeee6b8435 31b7e97770ffe74dad914a37a78c8f9a7286c75b62b5fae1c4ec722837ad457e e56537d09156bb77f4821d5ce005c7840ec41890de233d88a1152f68110098cf 06056f83e93849124dc435166c1b463bf34bbf99ea5671221ddaf6641e3db4f4 8a563b3091b56eb0562f5442c90b4d28d4be2946a3dc4a225b4b96134f7e447b d6bffa45aa2448b2fb584713395b742e02ef77c1d54f125cd501240e0dd91a13 951a54d2c61c3257447c4ff5fd451ee581c76d3d4d88fa482b99f5410d7b7b6f

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

SneakyChef

Type: Unknown Active

adaptation Thallium Black Banshee Mythic Leopard Transparent Tribe +11 more

Infrastructure 31 IOC(s)

50%

Domain

cisa.gov TEMP.Periscope W32.Stuxnet OSX.WindTail Dr.Web +26

Artifacts (9)

update.dll regsvr32.exe 8db5a7efe1a83e43cb4acdc596b0413b4beb54f9f8e13f978c07a6eeee6b8435 31b7e97770ffe74dad914a37a78c8f9a7286c75b62b5fae1c4ec722837ad457e e56537d09156bb77f4821d5ce005c7840ec41890de233d88a1152f68110098cf 06056f83e93849124dc435166c1b463bf34bbf99ea5671221ddaf6641e3db4f4 +3

Capability

50%

1 technique(s) 40 tool(s)/malware 24 CVE(s)

Aurora Backdoors BlackEnergy Cobalt Cobalt Strike Confucius Dark Dridex +32

T9000

Victim

70%

Targeted Sectors

government financial-services defense non-profit energy telecommunications media education critical-infrastructure healthcare aerospace manufacturing hospitality oil-gas think-tank food-agriculture aviation gaming retail utilities transportation pharmaceutical mining information-technology maritime chemical

Targeted Countries

CN US IN UA RU KR JP KZ KP VN SA PL TW PK MX IL BY IR GB AE DE AZ TR NL LB IT SY FR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges