Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

CosmicBeetle (threat actor)

Risk

100

Critical

32 techniques 46 tools/malware 8 vulnerabilities 39 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1590.005

IP Addresses reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

›

2 Weaponization

T1583.001

Domains resource development

T1587.001

Malware resource development

T1588.001

Malware resource development

T1588.002

Tool resource development

T1588.005

Exploits resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1204

User Execution execution

T1569.002

Service Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-0144

CVE CVE-2020-1472

CVE CVE-2021-42278

CVE CVE-2021-42287

CVE CVE-2022-42475

CVE CVE-2023-27532

CVE CVE-2024-40766

CVE CVE-2026-50522

›

5 Installation

T1110.001

Password Guessing credential access

T1212

Exploitation for Credential Access credential access

T1083

File and Directory Discovery discovery

T1135

Network Share Discovery discovery

T1136.001

Local Account persistence

T1136.002

Domain Account persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1021

Remote Services lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1490

Inhibit System Recovery impact

T1027.013

Encrypted/Encoded File stealth

T1070.004

File Deletion stealth

T1078

Valid Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1562.001

T1562.009

Stage risk: Critical High Medium None

Tools & Malware (46)

8Base Alphv BlackCat Cicada3301 Crisis Custom ransomware Custom ransomware strain Dark DarkSide Decryptor (ProtectionKey tool) DragonForce Embargo Embargo Ransomware Explorer FileCoder Gentlemen GitHub Global Havex RAT LockBit LockBit 3.0 LockBit 3.0 builder LockBit 3.0 builder (leaked) LockBit Black builder Matrix Nefilim POORTRY Payload Payload Plague PowerShell RansomHub Ransomware payload Rogue STOP ScHackTool ScRansom ScRansom ransomware Scarab Ransomware SpaceColon Spacecolon Stealc Trojan WinRM Windows Command Shell rock

Indicators of Compromise (39)

Domain

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public Filecoder.Spacecolon Horizon3.ai Agent.ECW Filecoder.Embargo MasterKeyPair.Private +10 more

Email Address

sunucuverikurtarma@gmail.com serverdatakurtarma@mail.ru threatintel@eset.com

Filename

Sysmon64.sys cmd.exe ekrn.exe ERAAgent.exe MsMpEng.exe Project1.exe stop.exe pay.exe +7 more

SHA-1 Hash

2BA12CD5E44839EA67DE8A07734A4E0303E5A3F8 28FD3345D82DA0CDB565A11C648AFF196F03D770 7310D6399683BA3EB2F695A2071E0E45891D743B

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (18)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more

Installation (11)

M1013 Application Developer Guidance M1019 Threat Intelligence Program M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +6 more

Command & Control (6)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program +1 more

Actions on Objectives (14)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1024 Restrict Registry Permissions +9 more

Detection Coverage

30 strategies

7/7 stages covered

Reconnaissance (2)

DET0815 Detection of IP Addresses DET0867 Detection of Vulnerability Scanning

Weaponization (5)

DET0827 Detection of Exploits DET0845 Detection of Malware DET0852 Detection of Tool DET0872 Detection of Malware DET0892 Detection of Domains

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (6)

DET0202 Behavioral Detection of Windows Command... DET0421 Detection Strategy for System Services S... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... +1 more

Installation (7)

DET0003 T1136.002 Detection Strategy - Domain Ac... DET0174 Detection Strategy for Exploitation for... DET0182 Behavior-chain detection for T1135 Netwo... DET0365 Detect Registry and Startup Folder Persi... DET0370 Recursive Enumeration of Files and Direc... +2 more

Command & Control (1)

DET0269 Behavioral Detection Strategy for Remote...

Actions on Objectives (8)

DET0087 Encrypted or Encoded File Payload Detect... DET0140 Behavioral Detection of Malicious File D... DET0146 Detection of Data Destruction Across Pla... DET0215 Detection of Multi-Platform File Encrypt... DET0275 Detect Adversary Deobfuscation or Decodi... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

CosmicBeetle

Type: Unknown Active

NoName EternalBlue Zerologon NONAME Repellent Scorpius +6 more

Infrastructure 18 IOC(s)

50%

Domain

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public Filecoder.Spacecolon Horizon3.ai +13

Artifacts (21)

sunucuverikurtarma@gmail.com serverdatakurtarma@mail.ru threatintel@eset.com Sysmon64.sys cmd.exe ekrn.exe +15

Capability

50%

32 technique(s) 46 tool(s)/malware 8 CVE(s)

8Base Alphv BlackCat Cicada3301 Crisis Custom ransomware Custom ransomware strain Dark +38

T1562.001 T1562.009

credential access

T1110.001 T1212

defense impairment

T1112

discovery

T1083 T1135

Victim

70%

Targeted Sectors

financial-services healthcare manufacturing pharmaceutical government education hospitality media energy defense

Targeted Countries

UA IN US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1590.005 T1595.002

Capability (Malware)

8Base Alphv BlackCat

Infrastructure

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public

2 Weaponization

Capability (Techniques)

T1583.001 T1587.001 T1588.001 T1588.002 T1588.005

Capability (Malware)

8Base Alphv BlackCat

Infrastructure

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

8Base Alphv BlackCat

Infrastructure

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.003 T1204 T1569.002

Capability (Malware)

8Base Alphv BlackCat

Infrastructure

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public

5 Installation

Capability (Techniques)

T1110.001 T1212 T1083 T1135 T1136.001

Capability (Malware)

8Base Alphv BlackCat

Infrastructure

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public

6 Command & Control

Capability (Techniques)

T1021

Capability (Malware)

8Base Alphv BlackCat

Infrastructure

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public

7 Actions on Objectives

Capability (Techniques)

T1485 T1486 T1490

Capability (Malware)

8Base Alphv BlackCat

Infrastructure

5.97.0.mas.8d580ada.awus ExtraThreatIntel.md RunKeyPair.Public