Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ZeroSevenGroup (threat actor)

Risk

High

3 techniques 40 tools/malware 1 vulnerabilities 14 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2022-40684

›

5 Installation

T1098

Account Manipulation persistence

›

6 Command & Control

T1563

Remote Service Session Hijacking lateral movement

›

7 Actions on Objectives

T1134

Access Token Manipulation stealth

Stage risk: Critical High Medium None

Tools & Malware (40)

9002 RAT Akira Akira ransomware BLACKCOFFEE BLINDINGCAN Cobalt Dark Derusbi Enfal Ghost RAT GitHub Global Guard Hunters International Kevin LockBit LockBit ransomware Lynx Malwarebytes Metasploit Framework Mimikatz OilRig PLAY Phishing emails PittyTiger PlugX Poison Ivy RansomHub Rhysida STOP SUNBURST Stealc TEARDROP Trojan Unknown WhatsApp ZooPark metasploit nuclei phishing

Indicators of Compromise (14)

Domain

llms.txt cisa.gov web.archive.org demo-cloud.space FIRST.org fortiguard.com www.cisa.gov packetstormsecurity.com +4 more

Email Address

ics-cert@kaspersky.com

Filename

maintenance.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

8 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Installation (7)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +2 more

Command & Control (5)

M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1030 Network Segmentation M1042 Disable or Remove Feature or Program

Actions on Objectives (2)

M1018 User Account Management M1026 Privileged Account Management

Detection Coverage

3 strategies

3/7 stages covered

Installation (1)

DET0096 Account Manipulation Behavior Chain Dete...

Command & Control (1)

DET0079 Detection of Remote Service Session Hija...

Actions on Objectives (1)

DET0283 Behavior-chain detection for T1134 Acces...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ZeroSevenGroup

Type: Unknown Active

Infrastructure 12 IOC(s)

50%

Domain

llms.txt cisa.gov web.archive.org demo-cloud.space FIRST.org +7

Artifacts (2)

ics-cert@kaspersky.com maintenance.exe

Capability

50%

3 technique(s) 40 tool(s)/malware 1 CVE(s)

9002 RAT Akira Akira ransomware BLACKCOFFEE BLINDINGCAN Cobalt Dark Derusbi +32

lateral movement

T1563

persistence

T1098

stealth

T1134

Victim

70%

Targeted Sectors

manufacturing financial-services energy media construction transportation defense mining government oil-gas chemical non-profit education utilities healthcare

Targeted Countries

US BR IL SG AE UA MX FR IN RU PL DE

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

5 Installation

Capability (Techniques)

T1098

Capability (Malware)

9002 RAT Akira Akira ransomware

Infrastructure

llms.txt cisa.gov web.archive.org

6 Command & Control

Capability (Techniques)

T1563

Capability (Malware)

9002 RAT Akira Akira ransomware

Infrastructure

llms.txt cisa.gov web.archive.org