Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

OverFlame (threat actor)

Risk

Critical

21 techniques 42 tools/malware 4 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1590

Gather Victim Network Information reconnaissance

T1592

Gather Victim Host Information reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1204.001

Malicious Link execution

CVE CVE-2021-26828

CVE CVE-2021-26829

CVE CVE-2023-2339762

CVE CVE-2026-16812

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T0803

T0813

T0814

T0816

T0821

T0822

T0831

T0832

T0836

T0843

T0855

T0859

T0866

T0878

T0883

T0886

T0889

Stage risk: Critical High Medium None

Tools & Malware (42)

Atmosphere Babuk Backdoor malware Backdoors CL0P Dark Dark Storm Team DieNet DragonForce Emotet Expand Flame Ghost RAT GitHub Global Globe Guard Handala Havex RAT Hunter Keyloggers Legitimate Software Leverage Malwarebytes Meow Metasploit Nexus NotPetya NotPetya ransomware PlugX RansomHub Rootkit STOP SentinelOne Singularity Solar Stuxnet Telegram Trojan Web Shell metasploit phishing

Indicators of Compromise (40)

Domain

cisa.gov acs.orglett sys.sysconstraints sys.syscolumns c.COLUMNNUMBER www.ccdc.cam.ac.uk j.tetlet sql.shtm +16 more

Email Address

contact@resecurity.com data_request@ccdc.cam.ac.uk houk@chem.ucla.edu g.mcglacken@ucc.ie

Filename

M.E.Doc

IPv4 Address

45.14.247.87 2.181.103.232 92.43.161.74 77.91.122.234 6.2.1.3 80.210.133.38 5.106.148.199 45.157.234.199 +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

8 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (3)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention

Detection Coverage

4 strategies

3/7 stages covered

Reconnaissance (2)

DET0826 Detection of Gather Victim Host Informat... DET0869 Detection of Gather Victim Network Infor...

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0066 User Execution – Malicious Link (click →...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

OverFlame

Type: Unknown Active

root access Moutabal Baba a botnet NOBELIUM +1 more

Infrastructure 35 IOC(s)

50%

Domain

cisa.gov acs.orglett sys.sysconstraints sys.syscolumns c.COLUMNNUMBER +19

IPv4 Address

45.14.247.87 2.181.103.232 92.43.161.74 77.91.122.234 6.2.1.3 +6

Artifacts (5)

contact@resecurity.com data_request@ccdc.cam.ac.uk houk@chem.ucla.edu g.mcglacken@ucc.ie M.E.Doc

Capability

50%

21 technique(s) 42 tool(s)/malware 4 CVE(s)

Atmosphere Babuk Backdoor malware Backdoors CL0P Dark Dark Storm Team DieNet +34

T0803 T0813 T0814 T0816 +13

execution

T1204.001

initial access

T1566.001

reconnaissance

T1590 T1592

Victim

70%

Targeted Sectors

energy nuclear financial-services critical-infrastructure defense manufacturing utilities government healthcare media oil-gas non-profit transportation

Targeted Countries

RU UA FR US IL IR CN GB PL ES IT KP CA SA DE KR JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1590 T1592

Capability (Malware)

Atmosphere Babuk Backdoor malware

Infrastructure

cisa.gov acs.orglett sys.sysconstraints

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Atmosphere Babuk Backdoor malware

Infrastructure

cisa.gov acs.orglett sys.sysconstraints

4 Exploitation

Capability (Techniques)

T1204.001

Capability (Malware)

Atmosphere Babuk Backdoor malware

Infrastructure

cisa.gov acs.orglett sys.sysconstraints