Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

HellHounds (threat actor)

Risk

High

2 techniques 40 tools/malware 15 vulnerabilities 40 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2017-11882

CVE CVE-2019-0803

CVE CVE-2020-1472

CVE CVE-2022-22948

CVE CVE-2022-38028

CVE CVE-2022-41328

CVE CVE-2022-42475

CVE CVE-2022-47966

CVE CVE-2023-20867

CVE CVE-2023-23397

CVE CVE-2023-2868

CVE CVE-2023-34048

CVE CVE-2023-38831

CVE CVE-2023-42793

CVE CVE-2023-4966

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1622

Debugger Evasion stealth

T1179

Stage risk: Critical High Medium None

Tools & Malware (40)

Backdoors Beacon Cobalt Cobalt Strike Cobalt Strike BEACON Dark DarkTortilla DarkWatchman GitHub Global Infostealer Jackal Kapeka Kimsuky Leverage LightlessCan LockBit LockBit 3.0 Malware Moonstone Sleet Mosquito MuddyWater OilRig Payload Payload PhantomCore Phishing emails Pikabot PowerShell Rhysida SMALLTIGER ShadowPad Snatch Spear-phishing Telegram Trojan Unknown Winrar XDSpy phishing

Indicators of Compromise (40)

Domain

8.Belanger ponyexpress.site processlist.txt ldPruning.sh vcf2treemix.sh convertVCFtoEigenstrat.sh 1.Noack 2.Bowman +19 more

Email Address

jan.slapeta@sydney.edu.au ics-cert@kaspersky.com stephen.doyle@sanger.ac.uk

Filename

scilc.exe awards.exe vfhost.exe Complaint.doc mcods.exe bed.gz sc.exe UKAZ.PDF.ZIP +1 more

IPv4 Address

4.1.4.156

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Detection Coverage

1 strategies

1/7 stages covered

Actions on Objectives (1)

DET0371 Detection Strategy for Debugger Evasion...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

HellHounds

Type: Unknown Active

Strontium Fancy Bear APT35 Onyx Sleet Judgment Panda +35 more

Infrastructure 28 IOC(s)

50%

Domain

8.Belanger ponyexpress.site processlist.txt ldPruning.sh vcf2treemix.sh +22

IPv4 Address

4.1.4.156

Artifacts (12)

jan.slapeta@sydney.edu.au ics-cert@kaspersky.com stephen.doyle@sanger.ac.uk scilc.exe awards.exe vfhost.exe +6

Capability

50%

2 technique(s) 40 tool(s)/malware 15 CVE(s)

Backdoors Beacon Cobalt Cobalt Strike Cobalt Strike BEACON Dark DarkTortilla DarkWatchman +32

T1179

stealth

T1622

Victim

70%

Targeted Sectors

government defense financial-services manufacturing energy telecommunications transportation education critical-infrastructure aerospace pharmaceutical media construction information-technology nuclear healthcare maritime utilities food-agriculture aviation non-profit mining oil-gas retail think-tank

Targeted Countries

RU US IL TW UA KR AU CN IN TR BY AE BR EG IT ES KP SG PL NL CA AZ VN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges