Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

SongXY (threat actor)

Risk

Medium

2 techniques 42 tools/malware 1 vulnerabilities 38 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1193 - Spearphishing Attachments

T1203 - Exploitation for Client Execution

Stage risk: Critical High Medium None

Tools & Malware (42)

APT38 Anchor BLINDINGCAN Buhtrap CHINACHOPPER Carbon Cobalt DEADEYE Dark DarkHotel Ghost RAT Global Hafnium Hellsing Hidden Cobra Jackal Lynx Matrix Microsoft Equation Editor Exploit (CVE‑2018‑0798) Mirage Mythic Naikon Nexus Nitro PLAY Poseidon Predator RoyalRoad RTF Builder Samurai Shamoon Shark Spear-phishing TeamSpy Trojan Tsunami Turla Unknown VICEROY Void Wiper malware gcman phishing

Indicators of Compromise (38)

Domain

5.Natarajan TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie TEMP.Noble +28 more

Email Address

gzzhouqing@126.com

Filename

jitc-14-4-s001.docx

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

SongXY

Type: Unknown Active

Sakaguchi S Akiba H et al CLEC5A-HER2 online supplemental figure S4 +16 more

Infrastructure 36 IOC(s)

50%

Domain

5.Natarajan TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo +31

Artifacts (2)

gzzhouqing@126.com jitc-14-4-s001.docx

Capability

50%

2 technique(s) 42 tool(s)/malware 1 CVE(s)

APT38 Anchor BLINDINGCAN Buhtrap CHINACHOPPER Carbon Cobalt DEADEYE +34

T1193 - Spearphishing Attachments T1203 - Exploitation for Client Execution

Victim

70%

Targeted Sectors

government defense financial-services non-profit media telecommunications energy aerospace education information-technology maritime manufacturing think-tank healthcare pharmaceutical chemical mining critical-infrastructure hospitality legal-services nuclear entertainment

Targeted Countries

US CN IN GB JP DE KR IR RU SA TW FR CA IL TR VN AU KZ PK UA PL AE SG NL BR ES IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges