Kill Chain & Diamond Model Analysis

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

3 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (3)

M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Detection Coverage

1 strategies

1/7 stages covered

Exploitation (1)

DET0287 Exploitation for Client Execution – cros...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

EC2 Grouper

Type: Unknown Active

tracked as cpyy APT3 Gothic Panda UPS Team +16 more

Infrastructure 38 IOC(s)

50%

Domain

web3.js demo-cloud.space attack.mitre.org cisa.gov TEMP.Hermit +33

Artifacts (5)

Node.js Fondue.exe protobuf.js Next.js web3.js

Capability

50%

1 technique(s) 47 tool(s)/malware 40 CVE(s)

AWS CLI Akira Backdoors Brute Ratel C4 CALENDAR Chaos ClickFix Cobalt +39

execution

T1203

Victim

70%

Targeted Sectors

government financial-services defense telecommunications healthcare non-profit energy education hospitality critical-infrastructure media aerospace mining pharmaceutical maritime gaming nuclear information-technology retail aviation manufacturing think-tank legal-services transportation utilities chemical entertainment

Targeted Countries

CN US IR GB IN JP KR TW UA DE CA RU PL FR SA TR AU AE SG IL BR IT RO KZ PK KP ES VN MX NL IQ BY SY EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1203

Capability (Malware)

AWS CLI Akira Backdoors

Infrastructure

web3.js demo-cloud.space attack.mitre.org