Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TOXCAR CYBER TEAM (threat actor)

Risk

High

5 techniques 53 tools/malware 36 vulnerabilities 35 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1204

User Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2014-8361

CVE CVE-2015-1701

CVE CVE-2015-2051

CVE CVE-2016-6277

CVE CVE-2017-10271

CVE CVE-2017-18368

CVE CVE-2017-9841

CVE CVE-2018-10562

CVE CVE-2019-0193

CVE CVE-2019-11510

CVE CVE-2019-16920

CVE CVE-2019-2725

CVE CVE-2019-3396

CVE CVE-2019-3929

CVE CVE-2019-9670

CVE CVE-2019-9978

CVE CVE-2020-16846

CVE CVE-2020-25213

CVE CVE-2020-3452

CVE CVE-2021-21315

CVE CVE-2021-26855

CVE CVE-2021-3129

CVE CVE-2021-38647

CVE CVE-2021-44228

CVE CVE-2022-26134

CVE CVE-2023-20198

CVE CVE-2023-22527

CVE CVE-2023-29357

CVE CVE-2023-42793

CVE CVE-2023-47246

CVE CVE-2024-1709

CVE CVE-2024-21887

CVE CVE-2024-21893

CVE CVE-2024-24919

CVE CVE-2024-27198

CVE CVE-2026-16812

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1220

XSL Script Processing stealth

Stage risk: Critical High Medium None

Tools & Malware (53)

Agent Tesla Anchor Buhtrap CHINACHOPPER Cobalt Cobalt Strike CosmicDuke CozyDuke Crimson DEADEYE Dark DarkHotel ELMER GeminiDuke Ghost RAT Global Grizzly Steppe HammerDuke Havoc Hidden Cobra Hunter IRONHALO Jackal Lynx Matrix MiniDuke Mirage Mythic Naikon Nexus Nitro OilRig OnionDuke Phishing campaigns PinchDuke PlugX Poseidon Predator Samurai SeaDuke Sednit Shamoon Shark Spear-phishing Taidoor TeamSpy Tsunami Turla Unknown VICEROY Void gcman phishing

Indicators of Compromise (35)

Domain

www.granvuehomes.com.au TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie TEMP.Noble +25 more

Email Address

contact@resecurity.com

Filename

Node.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Exploitation (10)

M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation +5 more

Actions on Objectives (1)

M1038 Execution Prevention

Detection Coverage

5 strategies

3/7 stages covered

Delivery (2)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0478 User Execution – multi-surface behavior... DET0514 Detection Strategy for Exploitation for...

Actions on Objectives (1)

DET0205 Detect XSL Script Abuse via msxsl and wm...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

TOXCAR CYBER TEAM

Type: Unknown Active

cpyy APT3 Gothic Panda UPS Team TG-0110 +20 more

Infrastructure 33 IOC(s)

50%

Domain

www.granvuehomes.com.au TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo +28

Artifacts (2)

contact@resecurity.com Node.js

Capability

50%

5 technique(s) 53 tool(s)/malware 36 CVE(s)

Agent Tesla Anchor Buhtrap CHINACHOPPER Cobalt Cobalt Strike CosmicDuke CozyDuke +45

execution

T1204

initial access

T1189 T1566.001

privilege escalation

T1068

stealth

T1220

Victim

70%

Targeted Sectors

government financial-services defense non-profit telecommunications energy aerospace manufacturing information-technology media healthcare education pharmaceutical transportation maritime mining retail think-tank food-agriculture critical-infrastructure chemical hospitality entertainment construction utilities nuclear gaming legal-services aviation oil-gas

Targeted Countries

IN US CN GB JP KR DE AU RU FR TW IR IL CA SA PK TR KZ VN UA SG BR ES PL NL IT AE BY IQ MX RO SY AZ EG KP LB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001

Capability (Malware)

Agent Tesla Anchor Buhtrap

Infrastructure

www.granvuehomes.com.au TEMP.Veles Cyber.Anarchy.Squad

4 Exploitation

Capability (Techniques)

T1204 T1068

Capability (Malware)

Agent Tesla Anchor Buhtrap

Infrastructure