Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Earth Baxia (threat actor)

Risk

High

4 techniques 54 tools/malware 38 vulnerabilities 31 IOCs 2/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1203

Exploitation for Client Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-9841

CVE CVE-2018-0171

CVE CVE-2018-15133

CVE CVE-2018-20062

CVE CVE-2019-7256

CVE CVE-2019-9082

CVE CVE-2020-3259

CVE CVE-2021-36380

CVE CVE-2021-41773

CVE CVE-2021-44228

CVE CVE-2022-30190

CVE CVE-2022-41040

CVE CVE-2022-41082

CVE CVE-2022-4257

CVE CVE-2023-20198

CVE CVE-2023-20269

CVE CVE-2023-26347

CVE CVE-2023-29298

CVE CVE-2023-29357

CVE CVE-2023-33246

CVE CVE-2023-36884

CVE CVE-2023-38203

CVE CVE-2023-38205

CVE CVE-2023-42793

CVE CVE-2023-46604

CVE CVE-2023-46805

CVE CVE-2024-1708

CVE CVE-2024-1709

CVE CVE-2024-21887

CVE CVE-2024-3400

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-8088

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (54)

Agent Tesla Akira Akira ransomware AndroxGh0st Backdoors Charon ClickFix Cobalt Strike Cobalt Strike (customized components) ConnectWise EAGLEDOOR backdoor EAGLET Earth Berberoka GOFFEE GamblingPuppet Gentlemen GhostRedirector Global Global MINIBIKE Gunra Interlock Interlock ransomware MINIBIKE MiniBrowse MiniJunk Mythic Agent Nimbus Manticore Paper Werewolf Payload Payload PeckBirdy PhantomCore PhantomDL Phishing campaigns Phishing emails Phishing tools PipeMagic PlugX PowerShell Ransomware payload Ransomware payloads RustyClaw STOP ScreenConnect SnipBot Spear-phishing Spear‑Phishing Subtle Snail ToolShell Trojan Unknown WarLock Winrar phishing

Indicators of Compromise (31)

Domain

demo-cloud.space ASP.NET Files.txt BI.ZONE SSL.com 4ad74aab.cfd 4ad74aab.xyz Hunt.io +7 more

Email Address

ics-cert@kaspersky.com

Filename

msedge.dll cmd.exe rundll32.exe svchost.exe Node.js dogovor.vbe contract-2025-5.vbe application.vbe +4 more

IPv4 Address

25.3.2.20 47.238.184.9 26.2.5.11

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (5)

M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Detection Coverage

4 strategies

2/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0514 Detection Strategy for Exploitation for...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Earth Baxia

Type: Unknown Active

Storm-0978 targeting defense government entities in Europe North America Storm-0978 Tropical Scorpius +22 more

Infrastructure 18 IOC(s)

50%

Domain

demo-cloud.space ASP.NET Files.txt BI.ZONE SSL.com +10

IPv4 Address

25.3.2.20 47.238.184.9 26.2.5.11

Artifacts (13)

ics-cert@kaspersky.com msedge.dll cmd.exe rundll32.exe svchost.exe Node.js +7

Capability

50%

4 technique(s) 54 tool(s)/malware 38 CVE(s)

Agent Tesla Akira Akira ransomware AndroxGh0st Backdoors Charon ClickFix Cobalt Strike +46

execution

T1203

initial access

T1190 T1566.001

privilege escalation

T1068

Victim

70%

Targeted Sectors

government financial-services telecommunications defense manufacturing transportation critical-infrastructure education healthcare energy aviation retail aerospace media oil-gas food-agriculture construction mining entertainment utilities information-technology legal-services hospitality

Targeted Countries

CN TW RU US BY AU KZ BR KR JP CA SG VN TR KP GB EG IR

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Agent Tesla Akira Akira ransomware

Infrastructure

demo-cloud.space ASP.NET Files.txt

4 Exploitation

Capability (Techniques)

T1203 T1068

Capability (Malware)

Agent Tesla Akira Akira ransomware

Infrastructure

demo-cloud.space ASP.NET Files.txt