Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TA455 (threat actor)

Risk

High

7 techniques 46 tools/malware 22 vulnerabilities 39 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1203

Exploitation for Client Execution execution

T1204

User Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-0171

CVE CVE-2018-6065

CVE CVE-2021-26084

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-26318

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2024-3721

CVE CVE-2024-40711

CVE CVE-2024-40766

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-8088

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1193

Stage risk: Critical High Medium None

Tools & Malware (46)

Akira Backdoors Cobalt Cobalt Strike Custom Backdoor Custom backdoors Custom malware Custom tools GalaxyGato Global GoRed HTA/LNK Loader Imperial Kitten InvisiMole Kimsuky MINIBIKE MiniBrowse MiniJunk MuddyWater Mythic Mythic Agent Naikon Nexus OilRig Payload Payload Phishing campaigns Phishing emails PipeMagic Polyglot PowerShell RustyClaw ShadowPad Smoke Sandstorm SnailResin SnipBot Variant SocGholish Spear-phishing Turla UNC1549 Unknown Void Winnti XDSpy Zebrocy phishing

Indicators of Compromise (39)

Domain

TEMP.Isotope TEMP.Veles bokhoreshonline.com TEMP.Zagros ASP.NET TEMP.Jumper TEMP.Periscope TEMP.Hex +10 more

Email Address

rocke@live.cn ics-cert@kaspersky.com

Filename

06.2025.zip MMpLics.dll mshta.exe rundll32.exe electronica-2024.pdf Hyper-Info.exe about-indic.pdf cmd.exe +4 more

SHA-256 Hash

0c2ba2d13d1c0f3995fc5f6c59962cee2eb41eb7bdbba4f6b45cba315fd56327 0ad1251be48e25b7bc6f61b408e42838bf5336c1a68b0d60786b8610b82bd94c e692ff3b23bec757f967e3a612f8d26e45a87509a74f55de90833a0d04226626 336d9501129129b917b23c60b01b56608a444b0fbe1f2fdea5d5beb4070f1f14 394d76104dc34c9b453b5adaf06c58de8f648343659c0e0512dd6e88def04de3

IPv4 Address

46.30.190.96 104.238.57.61

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (5)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1054 Software Configuration

Exploitation (14)

M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention +9 more

Actions on Objectives (4)

M1017 User Training M1040 Behavior Prevention on Endpoint M1047 Audit M1049 Antivirus/Antimalware

Detection Coverage

6 strategies

3/7 stages covered

Delivery (1)

DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (4)

DET0287 Exploitation for Client Execution – cros... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... DET0514 Detection Strategy for Exploitation for...

Actions on Objectives (1)

DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

TA455

Type: Unknown Active

Storm-0978 Tropical Scorpius UNC2596 APT34 Smoke Sandstorm +60 more

Infrastructure 20 IOC(s)

50%

Domain

TEMP.Isotope TEMP.Veles bokhoreshonline.com TEMP.Zagros ASP.NET +13

IPv4 Address

46.30.190.96 104.238.57.61

Artifacts (19)

rocke@live.cn ics-cert@kaspersky.com 06.2025.zip MMpLics.dll mshta.exe rundll32.exe +13

Capability

50%

7 technique(s) 46 tool(s)/malware 22 CVE(s)

Akira Backdoors Cobalt Cobalt Strike Custom Backdoor Custom backdoors Custom malware Custom tools +38

T1193

execution

T1059.001 T1203 T1204

initial access

T1566.002

privilege escalation

T1068

Victim

70%

Targeted Sectors

government defense financial-services telecommunications manufacturing aerospace education healthcare energy transportation non-profit critical-infrastructure aviation media think-tank retail pharmaceutical hospitality maritime information-technology chemical legal-services entertainment construction food-agriculture utilities mining oil-gas nuclear gaming

Targeted Countries

US RU CN UA IR AE IL BY VN PK IN TW JP KR PL TR KZ SA GB DE AU LB SG CA FR BR IT MX IQ ES EG RO NG KP AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.002

Capability (Malware)

Akira Backdoors Cobalt

Infrastructure

TEMP.Isotope TEMP.Veles bokhoreshonline.com

4 Exploitation

Capability (Techniques)

T1059.001 T1203 T1204 T1068

Capability (Malware)

Akira Backdoors Cobalt

Infrastructure

TEMP.Isotope TEMP.Veles bokhoreshonline.com