Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-0249 (threat actor)

Risk

Critical

9 techniques 45 tools/malware 11 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1204.002

Malicious File execution

CVE CVE-2015-3113

CVE CVE-2015-5119

CVE CVE-2017-11882

CVE CVE-2020-12812

CVE CVE-2024-3400

CVE CVE-2025-14174

CVE CVE-2025-22457

CVE CVE-2025-43529

CVE CVE-2025-55182

CVE CVE-2025-59718

CVE CVE-2025-59719

›

5 Installation

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

›

6 Command & Control

T1074.001

Local Data Staging collection

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1685

Disable or Modify Tools defense impairment

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (45)

APT38 Akira BRc4 BazaLoader BlackEnergy Bumblebee Carbanak Carbon ClickFix Cobalt Dark DarkHotel Emotet Explorer Global Gold Dragon Hafnium Hunter IcedID Kimsuky Latrodectus Leverage LockBit Machete Medusa Microsoft Defender XDR MuddyWater Naikon OilRig PLAY Payload Phishing campaigns Phishing emails PowerShell Qilin Remcos ScreenConnect Sofacy Tasklist Trojan Tsunami Turla Void Winnti phishing

Indicators of Compromise (40)

Domain

Backdoor.Linfo TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex macOS.OSAMiner Backdoor.Oldrea +13 more

Email Address

rocke@live.cn

Filename

MsBuild.exe egui.exe enterprise-attack-v17.1-software.xlsx explorer.exe dfrgui.exe avp.exe Tasklist.exe Microsoft.IdentityServer.ServiceHost.exe +9 more

IPv4 Address

181.49.105.59

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (3)

M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (11)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +6 more

Detection Coverage

9 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0294 User Execution – Malicious File via down...

Installation (2)

DET0034 Detection of Adversarial Process Discove... DET0525 System Discovery via Native and Remote U...

Command & Control (2)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0261 Detection of Local Data Staging Prior to...

Actions on Objectives (3)

DET0378 Behavioral Detection of Obfuscated Files... DET0497 Detection of Defense Impairment through... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-0249

Type: Unknown Active

DEV-0249 tracked as response solutions Sandworm Team Operation Cleaver +9 more

Infrastructure 22 IOC(s)

50%

Domain

Backdoor.Linfo TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope +16

IPv4 Address

181.49.105.59

Artifacts (18)

rocke@live.cn MsBuild.exe egui.exe enterprise-attack-v17.1-software.xlsx explorer.exe dfrgui.exe +12

Capability

50%

9 technique(s) 45 tool(s)/malware 11 CVE(s)

APT38 Akira BRc4 BazaLoader BlackEnergy Bumblebee Carbanak Carbon +37

collection

T1074.001

command and control

T1105

defense impairment

T1685

discovery

T1057 T1082

Victim

70%

Targeted Sectors

government financial-services telecommunications defense healthcare education manufacturing non-profit critical-infrastructure media energy pharmaceutical think-tank aviation hospitality aerospace retail information-technology mining transportation chemical gaming utilities maritime legal-services nuclear entertainment oil-gas construction

Targeted Countries

US CN RU GB IR IL UA KR AE VN JP DE PL AU SA IN PK TW FR KP BY SG RO CA TR MX ES AZ EG NG IT LB KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

APT38 Akira BRc4

Infrastructure

Backdoor.Linfo TEMP.Veles TEMP.Zagros

4 Exploitation

Capability (Techniques)

T1204.002

Capability (Malware)

APT38 Akira BRc4

Infrastructure

Backdoor.Linfo TEMP.Veles TEMP.Zagros

5 Installation

Capability (Techniques)

T1057 T1082

Capability (Malware)

APT38 Akira BRc4

Infrastructure

Backdoor.Linfo TEMP.Veles TEMP.Zagros

6 Command & Control

Capability (Techniques)

T1074.001 T1105

Capability (Malware)

APT38 Akira BRc4

Infrastructure

Backdoor.Linfo TEMP.Veles TEMP.Zagros