Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Lifting Zmiy (threat actor)

Risk

Medium

0 techniques 40 tools/malware 10 vulnerabilities 39 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2012-0158

CVE CVE-2015-1701

CVE CVE-2017-11882

CVE CVE-2023-38950

CVE CVE-2023-38951

CVE CVE-2023-38952

CVE CVE-2024-11182

CVE CVE-2025-33053

CVE CVE-2025-44277

CVE CVE-2025-44288

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Anubis Backdoors Buhtrap ClickFix Cobalt DEADEYE Dark DarkHotel Global Hidden Cobra Jackal Lynx Malware Matrix Mirage MuddyWater Mythic Naikon Nexus Nitro OilRig Payload Payload PhantomCore Phishing emails Poseidon PowerShell Samurai Sednit ShadowPad Shark Sofacy Spear-phishing TeamSpy Tsunami Turla Unknown VICEROY Void phishing

Indicators of Compromise (39)

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +15 more

Filename

VALIDATOR.msi 1Findstr.exe conditions.rar Document.hta pdf.scr pdf.exe cmd.exe explorer.exe +8 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Lifting Zmiy

Type: Unknown Active

Black Owl Hoody Hyena APT28 Fancy Bear has been +35 more

Infrastructure 23 IOC(s)

50%

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +18

Artifacts (16)

VALIDATOR.msi 1Findstr.exe conditions.rar Document.hta pdf.scr pdf.exe +10

Capability

50%

40 tool(s)/malware 10 CVE(s)

Anubis Backdoors Buhtrap ClickFix Cobalt DEADEYE Dark DarkHotel +32

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy aerospace media education manufacturing healthcare information-technology transportation pharmaceutical maritime think-tank construction retail critical-infrastructure utilities chemical nuclear entertainment hospitality mining gaming legal-services aviation oil-gas food-agriculture

Targeted Countries

US CN RU GB IN KR JP DE IR TW CA SA FR IL TR AU PK KZ UA ES VN BR PL SG NL AE IT BY IQ MX RO SY AZ EG LB

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges