Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-0494 (threat actor)

Risk

Critical

13 techniques 45 tools/malware 3 vulnerabilities 38 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.007

JavaScript execution

CVE CVE-2024-40766

CVE CVE-2025-55182

CVE CVE-2026-58644

›

5 Installation

T1003.003

NTDS credential access

T1212

Exploitation for Credential Access credential access

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1102

Web Service command and control

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1222.001

Windows Permissions defense impairment

T1027

Obfuscated Files or Information stealth

T1070.001

T1629

Stage risk: Critical High Medium None

Tools & Malware (45)

Akira ClickFix Cobalt DragonForce Emissary EtterSilent (macro‑enabled Excel) Explorer Gentlemen Global GootLoader Gootloader INC Ransomware Imperial Kitten Interlock Jackal Labyrinth Chollima LockBit Lorem Ipsum Node.js OilRig OysterLoader / CleanUpLoader / Broomstick PHOTO Payload Payload Persistence mechanisms Phishing tools PowerShell RansomHub React2Shell Rhysida STOP Storm-0501 Group Supper Tsunami Tsundere Tsundere Bot Unknown VBScript Vanilla Tempest (DEV-0832) Wicked WinRM XWorm phishing rhysida Ransomware route

Indicators of Compromise (38)

Domain

domain.tld WScript.FullName BIG.BOOM Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet wp-comments-post.php Shell.Application TEMP.Zagros +4 more

Filename

powershell.exe cmd.exe Node.js node.exe wscript.exe RegSvcs.exe Regedit.exe execute.bat +5 more

SHA-256 Hash

bbedc389af45853493c95011d9857f47241a36f7f159305b097089866502ac99 441c49b6338ba25519fc2cf1f5cb31ba51b0ab919c463671ab5c7f34c5ce2d30 cf44aa11a17b3dad61cae715f4ea27c0cbf80732a1a7a1c530a5c9d3d183482a

IPv4 Address

94.159.113.37 85.208.84.208 178.16.52.242 94.159.113.64 193.17.183.126 80.64.19.148 85.236.25.119

URL

http:///ssd http://www.wagenbaugrabs.ch/ http://cortinaspraga.com/

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (8)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +3 more

Installation (9)

M1013 Application Developer Guidance M1017 User Training M1019 Threat Intelligence Program M1026 Privileged Account Management M1027 Password Policies +4 more

Command & Control (2)

M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention

Actions on Objectives (7)

M1017 User Training M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint +2 more

Detection Coverage

11 strategies

5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0264 Cross-Platform Detection of JavaScript E... DET0441 Detection of Suspicious Scheduled Task C...

Installation (3)

DET0174 Detection Strategy for Exploitation for... DET0365 Detect Registry and Startup Folder Persi... DET0586 Detection of NTDS.dit Credential Dumping...

Command & Control (1)

DET0425 Suspicious Use of Web Services for C2

Actions on Objectives (3)

DET0280 Behavior-Based Registry Modification Det... DET0378 Behavioral Detection of Obfuscated Files... DET0418 Windows DACL Manipulation Behavioral Cha...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-0494

Type: Unknown Active

Vice Society Storm-0900 EtterSilent Storm-0494 by MSTIC DEV-0832 +2 more

Infrastructure 22 IOC(s)

50%

Domain

domain.tld WScript.FullName BIG.BOOM Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet +7

IPv4 Address

94.159.113.37 85.208.84.208 178.16.52.242 94.159.113.64 193.17.183.126 +2

URL

http:///ssd http://www.wagenbaugrabs.ch/ http://cortinaspraga.com/

Artifacts (16)

powershell.exe cmd.exe Node.js node.exe wscript.exe RegSvcs.exe +10

Capability

50%

13 technique(s) 45 tool(s)/malware 3 CVE(s)

Akira ClickFix Cobalt DragonForce Emissary EtterSilent (macro‑enabled Excel) Explorer Gentlemen +37

T1070.001 T1629

command and control

T1102

credential access

T1003.003 T1212

defense impairment

T1112 T1222.001

Victim

70%

Targeted Sectors

healthcare financial-services non-profit government defense manufacturing critical-infrastructure think-tank media construction

Targeted Countries

US AU IL DE GB RU KP IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Akira ClickFix Cobalt

Infrastructure

domain.tld WScript.FullName BIG.BOOM

4 Exploitation

Capability (Techniques)

T1053.005 T1059.007

Capability (Malware)

Akira ClickFix Cobalt

Infrastructure

domain.tld WScript.FullName BIG.BOOM

5 Installation

Capability (Techniques)

T1003.003 T1212 T1547.001

Capability (Malware)

Akira ClickFix Cobalt

Infrastructure

domain.tld WScript.FullName BIG.BOOM

6 Command & Control

Capability (Techniques)

T1102

Capability (Malware)

Akira ClickFix Cobalt

Infrastructure

domain.tld WScript.FullName BIG.BOOM