Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ALTDOS (threat actor)

Risk

Medium

0 techniques 44 tools/malware 0 vulnerabilities 40 IOCs 0/7 stages covered

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (44)

Aisuru Akira Alphv BRAIN Backdoors BianLian BlackCat Botnets Clop Cobalt Custom backdoors Custom malware Dark DarkSide Dridex Ferocious Global Guard Hermit Hive Hook Jackal Kali Linux Kimsuky Matrix Maze Medusa Nexus PLAY Phishing campaigns REvil Royal Ryuk STOP SentinelOne Singularity Social engineering tactics Spear-phishing Spear-phishing Campaigns Telegram Trojan Wicked Zero-day exploits phishing

Indicators of Compromise (40)

Domain

demo-cloud.space cisa.gov TEMP.Hermit TEMP.Zagros Huntresswindow.dataLayer window.dataLayer window.dataLayer.push css-zkupf3.builder +21 more

Filename

back-to-top-CP4tM4wd.js root-DUqqBS9Q.js site-chrome-DJZX4Zzx.js IagwX-xR.js builder-registry-DkysLYEM.js entry.client-BB3wyzmd.js chunk-LFPYN7LY-CAUjWit1.js asset.constants-qRmerz8o.js +2 more

MD5 Hash

2ddea77933e345319f335529d35b6c1a

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ALTDOS

Type: Unknown Active

other aliases Jumpy Pisces several other aliases first identified in 2014 0mid16B +75 more

Infrastructure 29 IOC(s)

50%

Domain

demo-cloud.space cisa.gov TEMP.Hermit TEMP.Zagros Huntresswindow.dataLayer +24

Artifacts (11)

back-to-top-CP4tM4wd.js root-DUqqBS9Q.js site-chrome-DJZX4Zzx.js IagwX-xR.js builder-registry-DkysLYEM.js entry.client-BB3wyzmd.js +5

Capability

50%

44 tool(s)/malware

Aisuru Akira Alphv BRAIN Backdoors BianLian BlackCat Botnets +36

Victim

70%

Targeted Sectors

financial-services government defense healthcare telecommunications critical-infrastructure manufacturing media education energy retail gaming aerospace non-profit aviation transportation think-tank hospitality maritime legal-services utilities

Targeted Countries

RU US SG IR CN IN BR KP KR CA GB TR UA VN

Diamond Model Meta-Features

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges