Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ExCobalt (threat actor)

Risk

Medium

0 techniques 40 tools/malware 22 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2016-4117

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2017-8759

CVE CVE-2018-6065

CVE CVE-2019-11580

CVE CVE-2021-26084

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-22948

CVE CVE-2022-26318

CVE CVE-2022-38028

CVE CVE-2022-41328

CVE CVE-2023-20867

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2023-34048

CVE CVE-2023-38831

CVE CVE-2024-3721

CVE CVE-2024-40711

CVE CVE-2024-40766

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Akira AnyDesk BADAUDIO BLINDINGCAN Backdoors Beacon C2 infrastructure Cobalt Cobalt Strike Custom malware GalaxyGato GitHub Global GoRed Interception Kapeka Kimsuky Moonstone Sleet MuddyWater Mythic Payload Payload PhantomCore PhantomVAI Phishing campaigns Phishing emails PowerShell Red Likho Sharp7Extend SocGholish Spear-phishing Spear-phishing emails Telegram UNC1549 Unknown VBShower Void Web Shells WildFire phishing

Indicators of Compromise (40)

Domain

Windows.jpg zamstats.me gouvn.me raw.githubusercontent.com cisa.gov NTDS.dit Mallory.ai BI.ZONE +14 more

Email Address

ics-cert@kaspersky.com

Filename

2016.pdf once.rtf EPSecurityService.exe SentinelUI.exe MMpLics.dll Complaint.doc NortonSecurity.exe conhost.exe +9 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ExCobalt

Type: Unknown Active

APT44 Seashell Blizzard Storm-0978 Tropical Scorpius Onyx Sleet +47 more

Infrastructure 22 IOC(s)

50%

Domain

Windows.jpg zamstats.me gouvn.me raw.githubusercontent.com cisa.gov +17

Artifacts (18)

ics-cert@kaspersky.com 2016.pdf once.rtf EPSecurityService.exe SentinelUI.exe MMpLics.dll +12

Capability

50%

40 tool(s)/malware 22 CVE(s)

Akira AnyDesk BADAUDIO BLINDINGCAN Backdoors Beacon C2 infrastructure Cobalt +32

Victim

70%

Targeted Sectors

government financial-services defense manufacturing transportation critical-infrastructure energy aerospace telecommunications education pharmaceutical mining construction aviation healthcare maritime food-agriculture retail media utilities information-technology chemical hospitality nuclear oil-gas entertainment

Targeted Countries

RU US CN UA TW IN KR IL BY DE BR MX TR EG IT IR FR CA GB PL VN SA JP NG

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges