Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-0506 (threat actor)

Risk

High

8 techniques 40 tools/malware 21 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2014-6352

CVE CVE-2018-13379

CVE CVE-2019-0604

CVE CVE-2019-11510

CVE CVE-2019-19781

CVE CVE-2020-10189

CVE CVE-2020-8243

CVE CVE-2020-8260

CVE CVE-2021-20016

CVE CVE-2021-22893

CVE CVE-2021-22894

CVE CVE-2021-22899

CVE CVE-2021-22900

CVE CVE-2021-31207

CVE CVE-2021-40444

CVE CVE-2021-43890

CVE CVE-2021-44228

CVE CVE-2022-30190

CVE CVE-2022-42475

CVE CVE-2024-3400

CVE CVE-2024-37085

›

5 Installation

T1082

System Information Discovery discovery

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1218.005

Mshta stealth

T1533

T1636.004

T5000

T9000

Stage risk: Critical High Medium None

Tools & Malware (40)

Akira BASTA ransomware BATLOADER Backdoor malware Backdoors Black Basta Black Basta ransomware BlackByte BlackCat Cobalt Cobalt Strike Conti Custom Backdoor DarkGate GitHub IcedID Kimsuky LockBit Microsoft Teams Mimikatz Mobile malware MuddyWater OilRig PLAY Payload Payload PowerShell PowerShell backdoor PsExec QakBot REvil Ransomware payloads Rootkit Ryuk SolarWinds TrickBot Trojan Turla Web Shell phishing

Indicators of Compromise (40)

Domain

expert.Hope DEADEYE.APPEND LITTLELAMB.WOOLTEA Trojan-SMS.AndroidOS.Agent.ao Trojan-SMS.AndroidOS.FakeInst Trojan-SMS.AndroidOS.OpFake Trojan.Mebromi Trojan-SMS.AndroidOS.Smaps +18 more

Filename

cmd.exe Node.js csc.exe certutil.exe arp.exe mshta.exe mobile-attack-v17.1.xlsx net.exe +6 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

4 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1038 Execution Prevention M1042 Disable or Remove Feature or Program

Detection Coverage

4 strategies

3/7 stages covered

Installation (1)

DET0525 System Discovery via Native and Remote U...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0506 Detecting Mshta-based Proxy Execution vi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-0506

Type: Unknown Active

FIN7 QBot QuackBot Pinkslipbot APT28 +16 more

Infrastructure 26 IOC(s)

50%

Domain

expert.Hope DEADEYE.APPEND LITTLELAMB.WOOLTEA Trojan-SMS.AndroidOS.Agent.ao Trojan-SMS.AndroidOS.FakeInst +21

Artifacts (14)

cmd.exe Node.js csc.exe certutil.exe arp.exe mshta.exe +8

Capability

50%

8 technique(s) 40 tool(s)/malware 21 CVE(s)

Akira BASTA ransomware BATLOADER Backdoor malware Backdoors Black Basta Black Basta ransomware BlackByte +32

T1533 T1636.004 T5000 T9000

command and control

T1071.001 T1105

discovery

T1082

stealth

T1218.005

Victim

70%

Targeted Sectors

financial-services government defense telecommunications manufacturing healthcare education energy transportation critical-infrastructure media information-technology retail aerospace hospitality mining pharmaceutical aviation non-profit maritime chemical legal-services nuclear gaming think-tank

Targeted Countries

US RU UA BR KR CN GB IN PL AU MX IL ES CA JP DE TR SY TW IT SA IR FR VN SG AE NL AZ KZ KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

5 Installation

Capability (Techniques)

T1082

Capability (Malware)

Akira BASTA ransomware BATLOADER

Infrastructure

expert.Hope DEADEYE.APPEND LITTLELAMB.WOOLTEA

6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

Akira BASTA ransomware BATLOADER

Infrastructure

expert.Hope DEADEYE.APPEND LITTLELAMB.WOOLTEA