Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Angry Likho (threat actor)

Risk

High

7 techniques 50 tools/malware 31 vulnerabilities 60 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

T1566.003

Spearphishing via Service initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1106

Native API execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-0171

CVE CVE-2018-0802

CVE CVE-2019-9621

CVE CVE-2019-9670

CVE CVE-2021-26855

CVE CVE-2021-26857

CVE CVE-2021-27065

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-3236

CVE CVE-2022-37969

CVE CVE-2023-22515

CVE CVE-2023-22518

CVE CVE-2023-46805

CVE CVE-2023-48788

CVE CVE-2024-21887

CVE CVE-2024-27198

CVE CVE-2024-49039

CVE CVE-2024-9680

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-68686

CVE CVE-2025-8088

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1086

Stage risk: Critical High Medium None

Tools & Malware (50)

ANDROMEDA AutoIt scripts BianLian BianLian Ransomware Charon ClickFix Cobalt Cobalt Strike CrowDoor Custom malware DEMODEX Rootkit DONOT Dark Deed RAT GHOSTSPIDER Global Gunra Infostealer Interlock Interlock ransomware Jackal LNK files LockBit Lumma Stealer MASOL RAT Linux Malicious files MetaStealer Mythic Naikon NeoReGeorg OceanLotus Payload Payload PhantomCore Phishing campaigns Phishing emails PipeMagic PlugX PowerShell SNAPPYBEE SideWinder SparrowDoor Subtle Snail Telegram Tomiris Turla Unknown Winrar frpc phishing

Indicators of Compromise (60)

Domain

syncagentsrv.exe demo-cloud.space attack.mitre.org telespazio-careers.com safrangroup-careers.com careers.com Trojan-Spy.VBS.Unicorn svchost.exe +28 more

Email Address

ics-cert@kaspersky.com

Filename

rundll32.exe svchost.exe powershell.exe Node.js syncagentsrv.exe Edge.exe explorer.exe mshta.exe +13 more

IPv4 Address

26.2.5.11 25.3.2.20

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (13)

M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention +8 more

Detection Coverage

6 strategies

2/7 stages covered

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0115 Detection Strategy for Spearphishing via... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0514 Detection Strategy for Exploitation for... DET0516 Behavioral Detection of Command and Scri... DET0529 Behavioral Detection of Native API Invoc...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Angry Likho

Type: Unknown Active

Sticky Werewolf Storm-0978 Tropical Scorpius tracked as MimiStick +65 more

Infrastructure 38 IOC(s)

50%

Domain

syncagentsrv.exe demo-cloud.space attack.mitre.org telespazio-careers.com safrangroup-careers.com +31

IPv4 Address

26.2.5.11 25.3.2.20

Artifacts (22)

ics-cert@kaspersky.com rundll32.exe svchost.exe powershell.exe Node.js syncagentsrv.exe +16

Capability

50%

7 technique(s) 50 tool(s)/malware 31 CVE(s)

ANDROMEDA AutoIt scripts BianLian BianLian Ransomware Charon ClickFix Cobalt Cobalt Strike +42

T1086

execution

T1059 T1106

initial access

T1190 T1566.001 T1566.003

privilege escalation

T1068

Victim

70%

Targeted Sectors

financial-services telecommunications manufacturing government defense transportation healthcare education retail construction energy critical-infrastructure pharmaceutical aerospace aviation food-agriculture mining oil-gas media entertainment chemical legal-services utilities hospitality maritime non-profit

Targeted Countries

RU BY US UA BR TR CN TW VN IN PK KZ CA JP DE SG AU KR IT GB EG SA AE FR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001 T1566.003

Capability (Malware)

ANDROMEDA AutoIt scripts BianLian

Infrastructure

syncagentsrv.exe demo-cloud.space attack.mitre.org

4 Exploitation

Capability (Techniques)

T1059 T1106 T1068

Capability (Malware)

ANDROMEDA AutoIt scripts BianLian

Infrastructure

syncagentsrv.exe demo-cloud.space attack.mitre.org