Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Nam3L3ss (threat actor)

Risk

Medium

1 techniques 40 tools/malware 2 vulnerabilities 32 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2023-34362

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1496

Resource Hijacking impact

Stage risk: Critical High Medium None

Tools & Malware (40)

Anchor Buhtrap Cl0p ransomware Clop Cobalt Crimson DEADEYE Dark DarkHotel Global Globe Hellsing Hidden Cobra Infostealer Jackal LockBit Lynx Matrix Mirage Mythic Naikon Nexus Nitro Poseidon Predator Samurai Shamoon Shark Snake Spear-phishing TeamSpy Trojan Tsunami Turla Unknown VICEROY Void gcman phishing rock

Indicators of Compromise (32)

Domain

www.hudsonrock.com TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +23 more

Filename

Payload.bin

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Detection Coverage

1 strategies

1/7 stages covered

Actions on Objectives (1)

DET0267 Resource Hijacking Detection Strategy

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Nam3L3ss

Type: Unknown Active

Synaptics worm CVE-2023-34362 cpyy APT3 Gothic Panda +13 more

Infrastructure 31 IOC(s)

50%

Domain

www.hudsonrock.com TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +26

Artifacts (1)

Payload.bin

Capability

50%

1 technique(s) 40 tool(s)/malware 2 CVE(s)

Anchor Buhtrap Cl0p ransomware Clop Cobalt Crimson DEADEYE Dark +32

impact

T1496

Victim

70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications aerospace media education manufacturing healthcare information-technology maritime think-tank pharmaceutical chemical mining retail hospitality legal-services nuclear entertainment

Targeted Countries

US CN GB IN JP DE KR IR RU SA TW IL FR CA TR AU KZ PK VN UA PL AE SG NL BR ES IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

7 Actions on Objectives

Capability (Techniques)

T1496

Capability (Malware)

Anchor Buhtrap Cl0p ransomware

Infrastructure