Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

SILKFIN AGENCY (threat actor)

Risk

Critical

37 techniques 52 tools/malware 2 vulnerabilities 39 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1059.001

PowerShell execution

T1129

Shared Modules execution

CVE CVE-2015-1701

CVE CVE-2024-39717

›

5 Installation

T1003

OS Credential Dumping credential access

T1010

Application Window Discovery discovery

T1012

Query Registry discovery

T1018

Remote System Discovery discovery

T1046

Network Service Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1120

Peripheral Device Discovery discovery

T1518.001

Security Software Discovery discovery

T1614

System Location Discovery discovery

T1543.003

Windows Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1056.001

Keylogging collection

T1074

Data Staged collection

T1071

Application Layer Protocol command and control

T1021.001

Remote Desktop Protocol lateral movement

T1091

Replication Through Removable Media lateral movement

›

7 Actions on Objectives

T1222

File and Directory Permissions Modification defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1489

Service Stop impact

T1027

Obfuscated Files or Information stealth

T1027.005

Indicator Removal from Tools stealth

T1036

Masquerading stealth

T1055

Process Injection stealth

T1134

Access Token Manipulation stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1202

Indirect Command Execution stealth

T1497

Virtualization/Sandbox Evasion stealth

T1564.003

Hidden Window stealth

T1064

T1562.001

T1574.002

Stage risk: Critical High Medium None

Tools & Malware (52)

Agent Tesla Anchor AttackNew (MedusaLocker variant) BitRAT Buhtrap Cobalt Copybara Crimson Custom MQTT‑based backdoor DEADEYE Dark DarkHotel EtherRat Fog ransomware Ghost RAT Global Grizzly Steppe Hidden Cobra Jackal Kimsuky Lynx Matrix Mimikatz Mirage Mythic Naikon Nexus Nitro OilRig PineFlower Poseidon PowerShell scripts Predator RansomHub Redline Stealer Samurai SeaDuke SectopRAT Sednit Shamoon Shark Solar Spear-phishing Sunburst TeamSpy Tsunami Turla Unknown VICEROY Void gcman phishing

Indicators of Compromise (39)

Domain

www.dephub.go.id TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie TEMP.Noble +23 more

Filename

7z.exe

IPv4 Address

45.95.11.52 80.71.157.55 95.164.86.148 167.88.173.173 104.194.152.251 45.87.153.79 91.194.161.109

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (5)

M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing M1049 Antivirus/Antimalware

Installation (15)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management +10 more

Command & Control (12)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +7 more

Actions on Objectives (17)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +12 more

Detection Coverage

34 strategies

4/7 stages covered

Exploitation (2)

DET0018 Behavior-chain, platform-aware detection... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (13)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0043 Detection Strategy for System Location D... DET0097 Detection of Application Window Enumerat... DET0209 Detection of Registry Query for Environm... +8 more

Command & Control (5)

DET0014 Detection of Data Staging Prior to Exfil... DET0089 Behavioral Detection of Keylogging Activ... DET0301 Removable Media Execution Chain Detectio... DET0327 Multi-event Detection Strategy for RDP-B... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (14)

DET0021 Behavioral Detection for Service Stop ac... DET0046 Detection Strategy for T1497 Virtualizat... DET0127 Behavioral Detection of Masquerading Acr... DET0128 Detection Strategy for Hidden Windows DET0146 Detection of Data Destruction Across Pla... +9 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

SILKFIN AGENCY

Type: Unknown Active

cpyy APT3 Gothic Panda UPS Team TG-0110 +18 more

Infrastructure 38 IOC(s)

50%

Domain

www.dephub.go.id TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo +26

IPv4 Address

45.95.11.52 80.71.157.55 95.164.86.148 167.88.173.173 104.194.152.251 +2

Artifacts (1)

7z.exe

Capability

50%

37 technique(s) 52 tool(s)/malware 2 CVE(s)

Agent Tesla Anchor AttackNew (MedusaLocker variant) BitRAT Buhtrap Cobalt Copybara Crimson +44

T1064 T1562.001 T1574.002

collection

T1056.001 T1074

command and control

T1071

credential access

T1003

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy aerospace media information-technology education healthcare manufacturing pharmaceutical maritime think-tank transportation chemical retail entertainment hospitality mining nuclear gaming legal-services critical-infrastructure utilities construction food-agriculture

Targeted Countries

US CN GB IN KR JP DE RU SA IR FR CA TW IL TR AU PK KZ ES IT PL UA VN BR SG NL BY RO AE IQ MX SY AZ KP EG LB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1059.001 T1129

Capability (Malware)

Agent Tesla Anchor AttackNew (MedusaLocker variant)

Infrastructure

www.dephub.go.id TEMP.Veles Cyber.Anarchy.Squad

5 Installation

Capability (Techniques)

T1003 T1010 T1012 T1018 T1046

Capability (Malware)

Agent Tesla Anchor AttackNew (MedusaLocker variant)

Infrastructure

www.dephub.go.id TEMP.Veles Cyber.Anarchy.Squad

6 Command & Control

Capability (Techniques)

T1056.001 T1074 T1071 T1021.001 T1091

Capability (Malware)

Agent Tesla Anchor AttackNew (MedusaLocker variant)

Infrastructure

www.dephub.go.id TEMP.Veles Cyber.Anarchy.Squad

7 Actions on Objectives

Capability (Techniques)

T1041 T1485 T1486 T1489

Capability (Malware)

Agent Tesla Anchor AttackNew (MedusaLocker variant)

Infrastructure