Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Awaken Likho (threat actor)

Risk

High

8 techniques 56 tools/malware 21 vulnerabilities 20 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-0802

CVE CVE-2019-9621

CVE CVE-2019-9670

CVE CVE-2021-26855

CVE CVE-2021-26857

CVE CVE-2021-27065

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-3236

CVE CVE-2022-37969

CVE CVE-2023-22515

CVE CVE-2023-22518

CVE CVE-2023-46805

CVE CVE-2023-48788

CVE CVE-2024-21887

CVE CVE-2024-27198

CVE CVE-2024-49039

CVE CVE-2024-9680

›

5 Installation

No data

›

6 Command & Control

T1071.004

DNS command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1055

Process Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (56)

AHK Bot ANDROMEDA Akira Ande Loader AnyDesk AutoIt AutoIt scripts Backdoors Bahamut BianLian BianLian Ransomware CSharp-Streamer-RAT Cobalt Cobalt Strike DONOT Dark Darktrack RAT Global Interlock Jackal LNK files Legitimate Software LockBit MESHAGENT MeshCentral MetaStealer MicrosoftStores.exe MuddyWater OceanLotus Payload Phishing emails PipeMagic PowerShell PowerShower backdoor Remote Utilities Resident backdoor Rhadamanthys RomCom RAT ScreenShotter ShadowPad SideWinder SmokeLoader Telegram TokenBuoy backdoor Tomiris Trojan Turla UltraVNC UltraVNC agent Unknown VBCloud implant VBShower backdoor Void WasabiSeed Zanubis phishing

Indicators of Compromise (20)

Domain

TEMP.Zagros NTDS.dit Mallory.ai BI.ZONE Trojan-Spy.VBS.Unicorn demo-cloud.space

Email Address

ics-cert@kaspersky.com

Filename

winword.exe VsGraphicsDesktopEngine.exe rc.exe mstsc.exe syncagentsrv.exe powershell.exe MicrosoftStores.exe rundll32.exe +5 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

15 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (7)

M1017 User Training M1019 Threat Intelligence Program M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1048 Application Isolation and Sandboxing +2 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint

Detection Coverage

8 strategies

4/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0514 Detection Strategy for Exploitation for...

Command & Control (2)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0400 Behavioral Detection of DNS Tunneling an...

Actions on Objectives (1)

DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Awaken Likho

Type: Unknown Active

Core Werewolf PseudoGamaredon the Newscaster Team APT-C-35 Origami Elephant +16 more

Infrastructure 6 IOC(s)

50%

Domain

TEMP.Zagros NTDS.dit Mallory.ai BI.ZONE Trojan-Spy.VBS.Unicorn +1

Artifacts (14)

ics-cert@kaspersky.com winword.exe VsGraphicsDesktopEngine.exe rc.exe mstsc.exe syncagentsrv.exe +8

Capability

50%

8 technique(s) 56 tool(s)/malware 21 CVE(s)

AHK Bot ANDROMEDA Akira Ande Loader AnyDesk AutoIt AutoIt scripts Backdoors +48

command and control

T1071.004 T1105

execution

T1059.003 T1203 T1204.002

initial access

T1566.001

privilege escalation

T1068

Victim

70%

Targeted Sectors

government financial-services manufacturing defense telecommunications energy pharmaceutical transportation education healthcare critical-infrastructure construction food-agriculture chemical retail maritime mining non-profit aviation

Targeted Countries

RU UA IN PK DE TR BY CN US KR JP IT VN BR TW SY SA AE FR CA AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

AHK Bot ANDROMEDA Akira

Infrastructure

TEMP.Zagros NTDS.dit Mallory.ai

4 Exploitation

Capability (Techniques)

T1059.003 T1203 T1204.002 T1068

Capability (Malware)

AHK Bot ANDROMEDA Akira

Infrastructure

TEMP.Zagros NTDS.dit Mallory.ai

6 Command & Control

Capability (Techniques)

T1071.004 T1105

Capability (Malware)

AHK Bot ANDROMEDA Akira

Infrastructure

TEMP.Zagros NTDS.dit Mallory.ai