Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

CloudSorcerer (threat actor)

Risk

Medium

2 techniques 40 tools/malware 0 vulnerabilities 8 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1053

Scheduled Task/Job execution

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1140

Deobfuscate/Decode Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (40)

Attor Backdoors Bahamut Buhtrap China Chopper CloudWizard Cobalt Custom Backdoor Custom backdoors Custom malware Custom tools DONOT Dark Gelsemium GitHub Global InvisiMole Jackal KONNI Kimsuky Lyceum Malware Mikroceen RAT Mimikatz MuddyWater OilRig OneDrive PowerShell RoundCube Sednit ShadowPad StrongPity Turla UAT-8302 Unknown VERMIN Winnti XDSpy Zebrocy phishing

Indicators of Compromise (8)

Domain

TEMP.Zagros file.io Mallory.ai 5.96.1.mas.f98f1e13.awus Yandex.Browser FalconFeeds.io

Filename

mspaint.exe msiexec.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

5 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (5)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1047 Audit

Detection Coverage

2 strategies

2/7 stages covered

Exploitation (1)

DET0094 Cross-Platform Behavioral Detection of S...

Actions on Objectives (1)

DET0275 Detect Adversary Deobfuscation or Decodi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

CloudSorcerer

Type: Unknown Active

APT34 Earth Preta Stately Taurus COLDRIVER SEABORGIUM +58 more

Infrastructure 6 IOC(s)

50%

Domain

TEMP.Zagros file.io Mallory.ai 5.96.1.mas.f98f1e13.awus Yandex.Browser +1

Artifacts (2)

mspaint.exe msiexec.exe

Capability

50%

2 technique(s) 40 tool(s)/malware

Attor Backdoors Bahamut Buhtrap China Chopper CloudWizard Cobalt Custom Backdoor +32

execution

T1053

stealth

T1140

Victim

70%

Targeted Sectors

government defense telecommunications financial-services non-profit education think-tank energy healthcare media critical-infrastructure manufacturing aerospace maritime pharmaceutical legal-services hospitality nuclear entertainment aviation chemical transportation utilities retail

Targeted Countries

RU CN UA US AE IL BY PK IN VN PL KR LB TR IR TW KZ JP IQ DE IT SA FR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1053

Capability (Malware)

Attor Backdoors Bahamut

Infrastructure

TEMP.Zagros file.io Mallory.ai