Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Natohub (threat actor)

Risk

Medium

4 techniques 53 tools/malware 1 vulnerabilities 15 IOCs 2/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1203

Exploitation for Client Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (53)

Anchor Buckeye Buhtrap CHINACHOPPER CloudDuke Cobalt CosmicDuke CozyDuke Crimson DEADEYE Dark DarkHotel ELMER GeminiDuke Global Globe Hafnium HammerDuke Hellsing Hidden Cobra IRONHALO Jackal KryBit Lumma Stealer Lynx Matrix MiniDuke Mirage Mythic Naikon Nexus Nitro OnionDuke PinchDuke Poseidon Predator SUNBURST Samurai SeaDuke Sednit Shamoon Shark Silence Snake Spear-phishing TeamSpy Tsunami Turla Unknown VICEROY Void gcman phishing

Indicators of Compromise (15)

Domain

demo-cloud.space attack.mitre.org TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao +7 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

12 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Exploitation (5)

M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Detection Coverage

4 strategies

2/7 stages covered

Delivery (2)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0514 Detection Strategy for Exploitation for...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Natohub

Type: Unknown Active

tracked as cpyy APT3 Gothic Panda UPS Team +15 more

Infrastructure 15 IOC(s)

50%

Domain

demo-cloud.space attack.mitre.org TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad +10

Capability

50%

4 technique(s) 53 tool(s)/malware 1 CVE(s)

Anchor Buckeye Buhtrap CHINACHOPPER CloudDuke Cobalt CosmicDuke CozyDuke +45

execution

T1203

initial access

T1189 T1566.001

privilege escalation

T1068

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications aviation aerospace energy media education information-technology maritime manufacturing think-tank healthcare pharmaceutical chemical mining critical-infrastructure hospitality legal-services nuclear entertainment

Targeted Countries

US CN GB IN JP DE IR KR CA RU SA TW IL FR TR AU KZ PK VN ES UA PL AE SG NL BR IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001

Capability (Malware)

Anchor Buckeye Buhtrap

Infrastructure

demo-cloud.space attack.mitre.org TEMP.Hermit

4 Exploitation

Capability (Techniques)

T1203 T1068

Capability (Malware)

Anchor Buckeye Buhtrap

Infrastructure

demo-cloud.space attack.mitre.org TEMP.Hermit