Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ScreamedJungle (threat actor)

Risk

High

7 techniques 46 tools/malware 4 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Command & Control

1 Reconnaissance

No data

›

2 Weaponization

T1588.005

Exploits resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059.007

JavaScript execution

CVE CVE-2015-1701

CVE CVE-2024-20720

CVE CVE-2024-34102

CVE CVE-2026-50522

›

5 Installation

T1082

System Information Discovery discovery

›

6 Command & Control

T1119

Automated Collection collection

T1071.001

Web Protocols command and control

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (46)

Bablosoft BrowserAutomationStudio Backdoors Basic Automation Suite (BAS) BlackMatter Buhtrap Cobalt Crimson CustomServers Dark DarkHotel DarkSide FingerprintSwitcher Ghost RAT GitHub Global Gootloader Grizzly Steppe Hidden Cobra Hunter IcedID Jackal Lynx Matrix Mimikatz MiniDionis Mirage Naikon Nexus OilRig Payload Payload Phoenix Poseidon RedLine Stealer SeaDuke Sednit Sofacy Spear-phishing TeamSpy Trojan Unknown VICEROY Void clientsafe.js openbullet phishing

Indicators of Compromise (40)

Domain

cisa.gov TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Noble TMP.Lapis TEMP.Jumper Temp.Overboard +22 more

Filename

clientSafe.js clientsafe.js

SHA-256 Hash

dcc1122bcf60d91acae0703de18ed4ac027f6d3d55eebd1e87c4f4647b2daeca

URL

http://screamedjungle.com/mjzNTg?pr=1 http://screamedjungle.com/clientsafe.js http://customfingerprints.bablosoft.com/save http://busz.io/clientsafe.js http://busz.io/j9z3GfPd?pr=1&sub_id_2={victim_domain}” http://busz.io/j9z3GfPd?pr=1 http://busz.io/j9z3GfPd?pr=1&sub_id_2={victim_domain}

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (10)

M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +5 more

Exploitation (4)

M1021 Restrict Web-Based Content M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program

Command & Control (4)

M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information

Detection Coverage

7 strategies

5/7 stages covered

Weaponization (1)

DET0827 Detection of Exploits

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0264 Cross-Platform Detection of JavaScript E...

Installation (1)

DET0525 System Discovery via Native and Remote U...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0186 Automated File and API Collection Detect...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ScreamedJungle

Type: Unknown Active

APT28 Pawn Storm Fancy Bear tracked as cpyy +17 more

Infrastructure 37 IOC(s)

50%

Domain

cisa.gov TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Noble +25

URL

Artifacts (3)

clientSafe.js clientsafe.js dcc1122bcf60d91acae0703de18ed4ac027f6d3d55eebd1e87c4f4647b2daeca

Capability

50%

7 technique(s) 46 tool(s)/malware 4 CVE(s)

Bablosoft BrowserAutomationStudio Backdoors Basic Automation Suite (BAS) BlackMatter Buhtrap Cobalt Crimson CustomServers +38

collection

T1119

command and control

T1071.001

discovery

T1082

execution

T1059.007

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy aerospace media healthcare pharmaceutical education information-technology manufacturing retail maritime think-tank entertainment gaming chemical hospitality transportation nuclear construction food-agriculture legal-services mining

Targeted Countries

US CN GB KR IN JP DE RU FR CA IR SA IL TW TR AU PK KZ ES BR SG NL IT UA PL BY VN IQ RO MX AE AZ SY KP LB EG

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.005

Capability (Malware)

Bablosoft BrowserAutomationStudio Backdoors Basic Automation Suite (BAS)

Infrastructure

cisa.gov TEMP.Avengers TEMP.Hippo

3 Delivery

Capability (Techniques)

T1189 T1190

Capability (Malware)

Bablosoft BrowserAutomationStudio Backdoors Basic Automation Suite (BAS)

Infrastructure

cisa.gov TEMP.Avengers TEMP.Hippo

4 Exploitation

Capability (Techniques)

T1059.007

Capability (Malware)

Bablosoft BrowserAutomationStudio Backdoors Basic Automation Suite (BAS)

Infrastructure

cisa.gov TEMP.Avengers TEMP.Hippo

5 Installation

Capability (Techniques)

T1082

Capability (Malware)

Bablosoft BrowserAutomationStudio Backdoors Basic Automation Suite (BAS)

Infrastructure

cisa.gov TEMP.Avengers TEMP.Hippo

6 Command & Control

Capability (Techniques)

T1119 T1071.001

Capability (Malware)

Bablosoft BrowserAutomationStudio Backdoors Basic Automation Suite (BAS)

Infrastructure

cisa.gov TEMP.Avengers TEMP.Hippo