Kill Chain & Diamond Model Analysis
Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.
Storm-2372
(threat actor)
13 techniques
41 tools/malware
2 vulnerabilities
43 IOCs
3/7 stages covered
Deepest: Installation
Stage risk:
Critical
High
Medium
None
Indicators of Compromise (43)
ATT&CK Tactic Coverage
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command & Control
Exfiltration
Impact
Recommended Mitigations
13 MITRE ATT&CK mitigations cover detected techniques
Browse all →
Detection Coverage
13 strategies
2/7 stages covered
Diamond Model of Intrusion
Adversary · Capability · Infrastructure · Victim
Storm-2372
Type: Unknown Active
tracked as
broader Midnight Blizzard operations
APT29
like TeamsPhisher
to distribute DarkGate malware
+1 more
13 technique(s) 41 tool(s)/malware 2 CVE(s)
Targeted Sectors
defense
government
telecommunications
media
non-profit
energy
information-technology
education
oil-gas
transportation
healthcare
construction
financial-services
aerospace
Targeted Countries
US
RU
CN
DE
CA
AU
Diamond Model Meta-Features
Direction
Adversary → Infrastructure → Victim
Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges
Activity Threads
Kill chain phase → Diamond Model event mapping