Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GOFFEE (threat actor)

Risk

Critical

25 techniques 65 tools/malware 18 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1059.006

Python execution

T1203

Exploitation for Client Execution execution

CVE CVE-2012-0158

CVE CVE-2017-11882

CVE CVE-2018-0171

CVE CVE-2023-38950

CVE CVE-2023-38951

CVE CVE-2023-38952

CVE CVE-2024-11182

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-33053

CVE CVE-2025-44277

CVE CVE-2025-44288

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-8088

›

5 Installation

T1555.003

Credentials from Web Browsers credential access

T1012

Query Registry discovery

T1016.002

Wi-Fi Discovery discovery

T1046

Network Service Discovery discovery

T1217

Browser Information Discovery discovery

T1176.001

Browser Extensions persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1005

Data from Local System collection

T1056.001

Keylogging collection

T1113

Screen Capture collection

T1115

Clipboard Data collection

T1021

Remote Services lateral movement

›

7 Actions on Objectives

T1685

Disable or Modify Tools defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1027.003

Steganography stealth

T1055

Process Injection stealth

T1078

Valid Accounts stealth

T1497

Virtualization/Sandbox Evasion stealth

T1678

Delay Execution stealth

Stage risk: Critical High Medium None

Tools & Malware (65)

APT38 Anubis Auto-Color Linux backdoor Backdoors ClickFix Cobalt Cobalt Strike Custom malware Dark EchoGather Explorer Fast Reverse Proxy (FRP) Global Gunra HXLibrary HanifNet Havoc Horus Agent Iediagcmd.exe Interlock Kimsuky KrustyLoader LockBit Medusa MeshCentral Agent MuddyWater Mythic Mythic C2 Naikon NeoExpressRAT Ngrok Open-source tools PathWiper Payload Payload Phantom Stealer PhantomCore Phishing Phishing campaigns Phishing emails PipeMagic Plink PowerModul PowerShell PowerTaskel RustyClaw Sednit ShadowPad Sliver SnipBot Spear-phishing Spearfishing SpyPress Subtle Snail SystemBC Telegram Trojan Unknown Void Web Shells WinRAR Winnti Winrar XPS Viewer phishing

Indicators of Compromise (39)

Domain

coffeebarometer.org Zagrebator.Dropper BI.ZONE PhantomeCore.GreqBackdoor mail.ru TEMP.Veles SSL.com kzst45.ru +5 more

Email Address

ics-cert@kaspersky.com

Filename

pdf.scr pdf.exe xsl.scr xlsx.scr fsutil.exe annual-review-2024-2025-e.pdf powershell.exe cmd.exe +13 more

SHA-256 Hash

0506a6fcee0d4bf731f1825484582180978995a8f9b84fc59b6e631f720915da b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32 74fab6adc77307ef9767e710d97c885352763e68518b2109d860bb45e9d0a8eb

IPv4 Address

172.64.80.1

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (10)

M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing +5 more

Installation (11)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1030 Network Segmentation +6 more

Command & Control (7)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program +2 more

Actions on Objectives (17)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +12 more

Detection Coverage

25 strategies

5/7 stages covered

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0063 Cross-Platform Behavioral Detection of P... DET0287 Exploitation for Client Execution – cros... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (7)

DET0013 Detection of Local Browser Artifact Acce... DET0037 Detect Suspicious Access to Browser Cred... DET0044 Detecting Malicious Browser Extensions A... DET0209 Detection of Registry Query for Environm... DET0365 Detect Registry and Startup Folder Persi... +2 more

Command & Control (5)

DET0089 Behavioral Detection of Keylogging Activ... DET0269 Behavioral Detection Strategy for Remote... DET0341 Clipboard Data Access with Anomalous Con... DET0346 Detect Screen Capture via Commands and A... DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (7)

DET0046 Detection Strategy for T1497 Virtualizat... DET0119 Detection Strategy for Steganographic Ab... DET0348 Detection Strategy for Exfiltration Over... DET0372 Multi-Platform Detection Strategy for T1... DET0497 Detection of Defense Impairment through... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GOFFEE

Type: Unknown Active

APT28 Paper Werewolf Fancy Bear tracked as the Red planet +83 more

Infrastructure 14 IOC(s)

50%

Domain

coffeebarometer.org Zagrebator.Dropper BI.ZONE PhantomeCore.GreqBackdoor mail.ru +8

IPv4 Address

172.64.80.1

Artifacts (25)

ics-cert@kaspersky.com pdf.scr pdf.exe xsl.scr xlsx.scr fsutil.exe +19

Capability

50%

25 technique(s) 65 tool(s)/malware 18 CVE(s)

APT38 Anubis Auto-Color Linux backdoor Backdoors ClickFix Cobalt Cobalt Strike Custom malware +57

collection

T1005 T1056.001 T1113 T1115

credential access

T1555.003

defense impairment

T1685

discovery

T1012 T1016.002 T1046 T1217

Victim

70%

Targeted Sectors

government financial-services telecommunications defense manufacturing education healthcare energy transportation critical-infrastructure media retail non-profit aerospace aviation construction hospitality pharmaceutical utilities oil-gas mining information-technology think-tank legal-services entertainment chemical gaming nuclear food-agriculture maritime

Targeted Countries

RU US CN TW VN JP IL UA AE AU BY IR SG TR KR SA CA GB PK IN BR KZ DE MX ES PL EG RO FR NG KP IT LB AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001 T1566.002

Capability (Malware)

APT38 Anubis Auto-Color Linux backdoor

Infrastructure

coffeebarometer.org Zagrebator.Dropper BI.ZONE

4 Exploitation

Capability (Techniques)

T1059.001 T1059.006 T1203

Capability (Malware)

APT38 Anubis Auto-Color Linux backdoor

Infrastructure

coffeebarometer.org Zagrebator.Dropper BI.ZONE

5 Installation

Capability (Techniques)

T1555.003 T1012 T1016.002 T1046 T1217

Capability (Malware)

APT38 Anubis Auto-Color Linux backdoor

Infrastructure

coffeebarometer.org Zagrebator.Dropper BI.ZONE

6 Command & Control

Capability (Techniques)

T1005 T1056.001 T1113 T1115 T1021

Capability (Malware)

APT38 Anubis Auto-Color Linux backdoor

Infrastructure

coffeebarometer.org Zagrebator.Dropper BI.ZONE

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

APT38 Anubis Auto-Color Linux backdoor

Infrastructure

coffeebarometer.org Zagrebator.Dropper BI.ZONE