Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC3973 (threat actor)

Risk

Critical

15 techniques 62 tools/malware 31 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059.003

Windows Command Shell execution

CVE CVE-2015-1701

CVE CVE-2020-1472

CVE CVE-2021-36942

CVE CVE-2021-44228

CVE CVE-2022-42045

CVE CVE-2023-27532

CVE CVE-2023-42789

CVE CVE-2023-48788

CVE CVE-2024-37085

CVE CVE-2024-55591

CVE CVE-2025-20700

CVE CVE-2025-20701

CVE CVE-2025-20702

CVE CVE-2025-26125

CVE CVE-2025-32433

CVE CVE-2025-33073

CVE CVE-2025-36911

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-55182

CVE CVE-2025-59718

CVE CVE-2025-59719

CVE CVE-2025-7771

CVE CVE-2026-20181

CVE CVE-2026-20190

CVE CVE-2026-4020

CVE CVE-2026-50656

CVE CVE-2026-8713

CVE CVE-2026-8863

›

5 Installation

T1110.004

Credential Stuffing credential access

T1018

Remote System Discovery discovery

›

6 Command & Control

T1530

Data from Cloud Storage collection

T1090

Proxy command and control

T1105

Ingress Tool Transfer command and control

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1486

Data Encrypted for Impact impact

T1078.002

Domain Accounts stealth

T1063

T1076

Stage risk: Critical High Medium None

Tools & Malware (62)

ADFIND BASTA ransomware Beacon Bloodhound Buhtrap COGSCAN Cobalt Cobalt Strike Cobalt Strike BEACON Crimson DARKGATE DEADEYE Dark DarkHotel Gentlemen Global Hidden Cobra Jackal KNOTROCK KNOTWRAP Lynx Matrix Mimikatz Mirage Naikon Nexus Nitro OilRig PORTYARD POWERSPLOIT POWERVIEW PSNMAP Payload Payload Poseidon PsExec QAKBOT QakBot QakBot RCLONE RDP SMB Beacon SYSTEMBC tunneler Samurai SeaDuke Sednit Shark Sofacy Spear-phishing SystemBC TeamSpy Tsunami Turla UNC2500 Unknown VICEROY Void WMI (Cobalt Strike) certutil gcman malvertising ad delivery phishing

Indicators of Compromise (40)

Domain

possible.If ldap.txt pc.txt online.txt goc.pdb TEMP.Hex TMP.Lapis took.Kaspersky +9 more

Filename

PoisonX.sys eb.sys nseckrnl.sys dmx.sys googleApiUtil64.sys ThrottleBlood.sys havoc.sys GameDriverX64.sys +1 more

IPv4 Address

45.148.10.120 138.226.246.94 176.65.148.30 45.148.10.95 193.32.162.60 173.199.90.188 213.111.148.90 94.154.32.160 +6 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

23 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Exploitation (4)

M1018 User Account Management M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Installation (4)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies

Command & Control (9)

M1018 User Account Management M1020 SSL/TLS Inspection M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +4 more

Actions on Objectives (9)

M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1031 Network Intrusion Prevention +4 more

Detection Coverage

13 strategies

5/7 stages covered

Delivery (2)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0364 Behavioral Detection Strategy for WMI Ex...

Installation (2)

DET0460 Credential Stuffing Detection via Reused... DET0574 Detection Strategy for Remote System Enu...

Command & Control (4)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0445 Detection of Proxy Infrastructure Setup... DET0484 Multi-Platform Cloud Storage Exfiltratio... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (3)

DET0210 Abuse of Domain Accounts DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC3973

Type: Unknown Active

APT28 Pawn Storm Fancy Bear Sednit Memory Integrity +16 more

Infrastructure 31 IOC(s)

50%

Domain

possible.If ldap.txt pc.txt online.txt goc.pdb +12

IPv4 Address

45.148.10.120 138.226.246.94 176.65.148.30 45.148.10.95 193.32.162.60 +9

Artifacts (9)

PoisonX.sys eb.sys nseckrnl.sys dmx.sys googleApiUtil64.sys ThrottleBlood.sys +3

Capability

50%

15 technique(s) 62 tool(s)/malware 31 CVE(s)

ADFIND BASTA ransomware Beacon Bloodhound Buhtrap COGSCAN Cobalt Cobalt Strike +54

T1063 T1076

collection

T1530

command and control

T1090 T1105

credential access

T1110.004

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications aerospace energy media education healthcare information-technology manufacturing pharmaceutical maritime think-tank chemical entertainment hospitality mining nuclear gaming legal-services retail transportation construction food-agriculture

Targeted Countries

US CN GB IN JP KR DE RU IR SA FR CA IL TW TR PK AU KZ UA ES PL SG VN NL BR IT BY AE IQ MX RO SY AZ EG LB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001

Capability (Malware)

ADFIND BASTA ransomware Beacon

Infrastructure

possible.If ldap.txt pc.txt

4 Exploitation

Capability (Techniques)

T1047 T1059.003

Capability (Malware)

ADFIND BASTA ransomware Beacon

Infrastructure

possible.If ldap.txt pc.txt

5 Installation

Capability (Techniques)

T1110.004 T1018

Capability (Malware)

ADFIND BASTA ransomware Beacon

Infrastructure

possible.If ldap.txt pc.txt

6 Command & Control

Capability (Techniques)

T1530 T1090 T1105 T1021.004

Capability (Malware)

ADFIND BASTA ransomware Beacon

Infrastructure

possible.If ldap.txt pc.txt

7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

ADFIND BASTA ransomware Beacon

Infrastructure

possible.If ldap.txt pc.txt