Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

AzzaSec (threat actor)

Risk

Medium

1 techniques 48 tools/malware 1 vulnerabilities 40 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1486

Data Encrypted for Impact impact

Stage risk: Critical High Medium None

Tools & Malware (48)

AzzaSec Ransomware Buhtrap Chaos Cobalt CyberVolk ransomware DEADEYE Dark DarkHotel Diamond RW Global Hafnium Hellsing HexaLocker Hidden Cobra Invisible/Doubleface ransomware Jackal Leverage LockBit Lockbit Lynx Matrix Mirage Mythic Naikon Nexus Nitro Parano (Paraodeus Ransomware) Phishing emails Poseidon Predator RansomHub Samurai ScreenLocker SentinelOne Shamoon Shark Spear-phishing Stealer script TeamSpy Telegram Tsunami Turla Unknown VICEROY Void Webshell gcman phishing

Indicators of Compromise (40)

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +8 more

SHA-1 Hash

16bf55122bbb6073cc1d77ce23e2a8e6052f9ec1 3bf6a90017bf22083ab735ecf3f8589a3f220e53 5d8bed459f55a37e2fcb801d04de337a01c5d623 813c510fb2463ecc6dff7795ef96744ca82544b3 b958fb7241cc9675b8dd967b02df6a6ad92de52d c70d2350cbac3d0abeb896adcce2fcf243943633 eae366ee4a7c19a87bc5ab9360f4333907a6a387 f5d0c94b2be91342dc01ecf2f89e7e6f21a74b90 +16 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

2 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Actions on Objectives (2)

M1040 Behavior Prevention on Endpoint M1053 Data Backup

Detection Coverage

1 strategies

1/7 stages covered

Actions on Objectives (1)

DET0215 Detection of Multi-Platform File Encrypt...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

AzzaSec

Type: Unknown Active

APT43 AzzaSecurity Double Alliance Paraodeus Ransomware From Russia with Love +20 more

Infrastructure 16 IOC(s)

50%

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +11

Artifacts (24)

Capability

50%

1 technique(s) 48 tool(s)/malware 1 CVE(s)

AzzaSec Ransomware Buhtrap Chaos Cobalt CyberVolk ransomware DEADEYE Dark DarkHotel +40

impact

T1486

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications media energy aerospace manufacturing transportation maritime education information-technology healthcare think-tank pharmaceutical critical-infrastructure chemical mining hospitality legal-services nuclear entertainment

Targeted Countries

US CN IN GB JP DE KR IR RU SA IL TW UA FR CA AE TR AU KZ PK VN PL ES IT SG NL BR IQ BY SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

7 Actions on Objectives

Capability (Techniques)

T1486

Capability (Malware)

AzzaSec Ransomware Buhtrap Chaos

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles