Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Anonymous KSA (threat actor)

Risk

Medium

2 techniques 44 tools/malware 1 vulnerabilities 33 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566

Phishing initial access

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1499

Endpoint Denial of Service impact

Stage risk: Critical High Medium None

Tools & Malware (44)

BLINDINGCAN Backdoors BeaverTail Brute Ratel Brute Ratel C4 Brute Ratel C4 Buhtrap Cobalt Crimson Dark DarkHotel Ghost RAT Ghost RAT Global Grizzly Steppe Hidden Cobra Hunter IcedID InvisibleFerret Jackal Lynx MiniDionis Mirage Naikon Nexus OilRig PHOTO Phoenix PlugX Poseidon RATel SUNBURST SeaDuke Sednit Sofacy Spear-phishing Sword TeamSpy Unknown VICEROY Void WAVESHAPER Winnti phishing

Indicators of Compromise (33)

Domain

working.Despite cisa.gov TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Noble Temp.Pittytiger possible.If +23 more

Email Address

Info@emad24.ir

IPv4 Address

18.227.57.42

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

7 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more

Actions on Objectives (1)

M1037 Filter Network Traffic

Detection Coverage

2 strategies

2/7 stages covered

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Actions on Objectives (1)

DET0208 Endpoint Resource Saturation and Crash P...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Anonymous KSA

Type: Unknown Active

was a series of cpyy APT3 Gothic Panda UPS Team +21 more

Infrastructure 32 IOC(s)

50%

Domain

working.Despite cisa.gov TEMP.Avengers TEMP.Hippo TEMP.Zhenbao +26

IPv4 Address

18.227.57.42

Artifacts (1)

Info@emad24.ir

Capability

50%

2 technique(s) 44 tool(s)/malware 1 CVE(s)

BLINDINGCAN Backdoors BeaverTail Brute Ratel Brute Ratel C4 Brute Ratel C4 Buhtrap Cobalt +36

impact

T1499

initial access

T1566

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications aerospace energy media healthcare pharmaceutical education information-technology manufacturing maritime think-tank entertainment gaming chemical retail hospitality transportation nuclear construction food-agriculture legal-services mining

Targeted Countries

US CN GB KR IN JP DE RU FR CA IL IR SA TW TR AU PK KZ ES BR SG NL IT UA PL BY VN IQ RO MX AE AZ SY LB EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

BLINDINGCAN Backdoors BeaverTail

Infrastructure

working.Despite cisa.gov TEMP.Avengers

7 Actions on Objectives

Capability (Techniques)

T1499

Capability (Malware)

BLINDINGCAN Backdoors BeaverTail

Infrastructure

working.Despite cisa.gov TEMP.Avengers