Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GamaCopy (threat actor)

Risk

Critical

14 techniques 55 tools/malware 9 vulnerabilities 41 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1587

Develop Capabilities resource development

T1587.001

Malware resource development

T1587.002

Code Signing Certificates resource development

T1587.003

Digital Certificates resource development

T1587.004

Exploits resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

CVE CVE-2015-1701

CVE CVE-2024-2617

CVE CVE-2025-4427

CVE CVE-2025-4428

CVE CVE-2025-53690

CVE CVE-2025-53770

CVE CVE-2026-21509

CVE CVE-2026-21513

CVE CVE-2026-50522

›

5 Installation

No data

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1497.001

System Checks stealth

T1090.005

Stage risk: Critical High Medium None

Tools & Malware (55)

AnyDesk AnyDesk Remote Host Management EXE BLINDINGCAN Buhtrap Cobalt Cobalt Strike Custom WinRAR Custom malware DCSrv DEADEYE Dark DarkHotel DynoWiper Global Handala Jackal Leverage LockBit LucidRook Matrix MiniDoor Outlook Macro Stealer Mirai IoT MuddyWater Naikon NetSupport Nexus Nitro OilRig Payload PhantomHeart PhantomProxyLite PhantomPxPigeon Phishing campaigns Phishing emails PixyNetLoader Covenant Grunt Poseidon PowerShell PyDCrypt STRRAT (Strigoi Master) Samurai Shamoon Smart Install Maker Spear-phishing Spear-phishing Campaigns TeamSpy Telegram Tsunami Turla UltraVNC Unknown VICEROY Void WhatsApp gcman phishing

Indicators of Compromise (41)

Domain

TEMP.Beanie gouvn.me attack.mitre.org cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +17 more

Email Address

ics-cert@kaspersky.com

Filename

v4.msi NGenTask.exe cmd.exe mscorsvc.dll ssh.exe phoneactivate.exe sppc.dll W3wp.exe +7 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

15 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (8)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention M1042 Disable or Remove Feature or Program +3 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1031 Network Intrusion Prevention M1057 Data Loss Prevention

Detection Coverage

13 strategies

5/7 stages covered

Weaponization (5)

DET0833 Detection of Code Signing Certificates DET0844 Detection of Digital Certificates DET0853 Detection of Develop Capabilities DET0872 Detection of Malware DET0894 Detection of Exploits

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (2)

DET0168 Virtualization/Sandbox Evasion via Syste... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GamaCopy

Type: Unknown Active

Awaken Likho APT28 Fancy Bear Mango Sandstorm Static Kitten +60 more

Infrastructure 25 IOC(s)

50%

Domain

TEMP.Beanie gouvn.me attack.mitre.org cisa.gov TEMP.Hermit +20

Artifacts (16)

ics-cert@kaspersky.com v4.msi NGenTask.exe cmd.exe mscorsvc.dll ssh.exe +10

Capability

50%

14 technique(s) 55 tool(s)/malware 9 CVE(s)

AnyDesk AnyDesk Remote Host Management EXE BLINDINGCAN Buhtrap Cobalt Cobalt Strike Custom WinRAR Custom malware +47

T1090.005

command and control

T1071.001 T1105

execution

T1053.005 T1059.001 T1059.003

exfiltration

T1041

Victim

70%

Targeted Sectors

government defense financial-services energy non-profit telecommunications manufacturing education aerospace maritime transportation media healthcare critical-infrastructure construction information-technology think-tank chemical mining pharmaceutical retail nuclear aviation utilities hospitality legal-services entertainment oil-gas

Targeted Countries

US RU CN UA GB IN DE PL JP KR SA IR KZ PK IL TR TW CA AE FR BR AU BY VN MX RO ES NL IT SG IQ SY KP NG EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1587 T1587.001 T1587.002 T1587.003 T1587.004

Capability (Malware)

AnyDesk AnyDesk Remote Host Management EXE BLINDINGCAN

Infrastructure

TEMP.Beanie gouvn.me attack.mitre.org

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

AnyDesk AnyDesk Remote Host Management EXE BLINDINGCAN

Infrastructure

TEMP.Beanie gouvn.me attack.mitre.org

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.003

Capability (Malware)

AnyDesk AnyDesk Remote Host Management EXE BLINDINGCAN

Infrastructure

TEMP.Beanie gouvn.me attack.mitre.org

6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

AnyDesk AnyDesk Remote Host Management EXE BLINDINGCAN

Infrastructure

TEMP.Beanie gouvn.me attack.mitre.org

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AnyDesk AnyDesk Remote Host Management EXE BLINDINGCAN

Infrastructure

TEMP.Beanie gouvn.me attack.mitre.org