Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-0940 (threat actor)

Risk

Critical

19 techniques 43 tools/malware 2 vulnerabilities 8 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589

Gather Victim Identity Information reconnaissance

›

2 Weaponization

T1584

Compromise Infrastructure resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

CVE CVE-2023-50224

CVE CVE-2025-9377

›

5 Installation

T1110

Brute Force credential access

T1110.003

Password Spraying credential access

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1071.002

File Transfer Protocols command and control

T1090

Proxy command and control

T1105

Ingress Tool Transfer command and control

T1571

Non-Standard Port command and control

T1665

Hide Infrastructure command and control

›

7 Actions on Objectives

T1685

Disable or Modify Tools defense impairment

T1027

Obfuscated Files or Information stealth

T1024 - Valid Accounts

T1059.003 - Remote System Discovery: Custom Command-line Tool

T1566.001 - Initial Access Provider in External Account

T1566.002 - Spearphishing Attachment

Stage risk: Critical High Medium None

Tools & Malware (43)

BeaverTail Botnets ClickFix Cobalt Cobalt Strike (inferred from APT tactics) CovertNetwork-1658 tools Credential Dumping Tools Crimson Crisis Custom credential theft frameworks Dark Destructive Malware Emissary Expand GitHub Global Imperial Kitten Infostealer Jackal Labyrinth Chollima Leverage Mango Microsoft Defender XDR Microsoft Teams Mythic OilRig Payload Phishing campaigns PlugX PowerShell Quad7 botnet Remote access trojans STOP Trojan Tsunami Unknown Void WhisperGate Wicked Winnti macOS ClickFix npm packages phishing

Indicators of Compromise (8)

Domain

adoption.Consider TEMP.Zagros TEMP.Periscope vnd.openxmlformats-officedocument.spreadsheetml.sheet MicrosoftMapping.json demo-cloud.space Censys.IO

Filename

enterprise-attack-v18.1-campaigns.xlsx

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (4)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies

Command & Control (4)

M1020 SSL/TLS Inspection M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1038 Execution Prevention +5 more

Detection Coverage

15 strategies

7/7 stages covered

Reconnaissance (1)

DET0841 Detection of Gather Victim Identity Info...

Weaponization (1)

DET0885 Detection of Compromise Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Installation (2)

DET0463 Brute Force Authentication Failures with... DET0487 Distributed Password Spraying via Authen...

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0227 Detection Strategy for Non-Standard Port... DET0411 Detection Strategy for Hide Infrastructu... DET0416 Detection of File Transfer Protocol-Base... +2 more

Actions on Objectives (2)

DET0378 Behavioral Detection of Obfuscated Files... DET0497 Detection of Defense Impairment through...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-0940

Type: Unknown Active

CovertNetwork-1658 ORB07 the 7777 Botnet xlogin

Infrastructure 7 IOC(s)

50%

Domain

adoption.Consider TEMP.Zagros TEMP.Periscope vnd.openxmlformats-officedocument.spreadsheetml.sheet MicrosoftMapping.json +2

Artifacts (1)

enterprise-attack-v18.1-campaigns.xlsx

Capability

50%

19 technique(s) 43 tool(s)/malware 2 CVE(s)

BeaverTail Botnets ClickFix Cobalt Cobalt Strike (inferred from APT tactics) CovertNetwork-1658 tools Credential Dumping Tools Crimson +35

T1024 - Valid Accounts T1059.003 - Remote System Discovery: Custom Command-line Tool T1566.001 - Initial Access Provider in External Account T1566.002 - Spearphishing Attachment

command and control

T1071 T1071.001 T1071.002 T1090 +3

credential access

T1110 T1110.003

defense impairment

T1685

Victim

70%

Targeted Sectors

government defense energy aviation healthcare maritime think-tank construction legal-services financial-services non-profit media

Targeted Countries

CN IL UA RU KP IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589

Capability (Malware)

BeaverTail Botnets ClickFix

Infrastructure

adoption.Consider TEMP.Zagros TEMP.Periscope

2 Weaponization

Capability (Techniques)

T1584

Capability (Malware)

BeaverTail Botnets ClickFix

Infrastructure

adoption.Consider TEMP.Zagros TEMP.Periscope

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

BeaverTail Botnets ClickFix

Infrastructure

adoption.Consider TEMP.Zagros TEMP.Periscope

4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

BeaverTail Botnets ClickFix

Infrastructure

adoption.Consider TEMP.Zagros TEMP.Periscope

5 Installation

Capability (Techniques)

T1110 T1110.003

Capability (Malware)

BeaverTail Botnets ClickFix

Infrastructure

adoption.Consider TEMP.Zagros TEMP.Periscope

6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1071.002 T1090 T1105

Capability (Malware)

BeaverTail Botnets ClickFix

Infrastructure

adoption.Consider TEMP.Zagros TEMP.Periscope