Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UAT-5918 (threat actor)

Risk

Critical

18 techniques 59 tools/malware 7 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1195.002

Compromise Software Supply Chain initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059.001

PowerShell execution

CVE CVE-2020-22653

CVE CVE-2020-22658

CVE CVE-2023-25717

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2025-2492

CVE CVE-2026-50656

›

5 Installation

T1003

OS Credential Dumping credential access

T1003.002

Security Account Manager credential access

T1555.005

Password Managers credential access

T1016.001

Internet Connection Discovery discovery

T1046

Network Service Discovery discovery

T1069

Permission Groups Discovery discovery

T1082

System Information Discovery discovery

T1136.001

Local Account persistence

›

6 Command & Control

T1021.001

Remote Desktop Protocol lateral movement

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1027.013

Encrypted/Encoded File stealth

T1078

Valid Accounts stealth

T1218

System Binary Proxy Execution stealth

Stage risk: Critical High Medium None

Tools & Malware (59)

AppDomainManager BITS Backdoors Browser credential stealers Chopper web shell Cobalt Custom malware DOGLEASH DOGLEASH backdoor Earthworm Expand FRPC FScan Fscan Group Policy Hook Impacket Interception In‑Swor JARLEASH JARLEASH backdoor JuicyPotato LONGLEASH LaZagne Leash MSBuild Matrix Metasploit Meterpreter Mimikatz MySQL Neo-reGeorg NetSpy Nexus Open-source tools Open‑source tools PortBrute PowerShell Process Hollowing Process Hollowing PuTTY pscp ReGeorg SHORTLEASH SNetCracker SQLCMD.exe ShortLeash TriBack Loader TriBack Loader Trojan UAT-8302 WMIC Web Shell Web Shells Windows Command Shell WmiExec netsh phishing systemd wmic

Indicators of Compromise (40)

Domain

groups.There Snort.org wmiexec.py Unix.Backdoor Unix.Backdoor.Agent laz.txt pw.txt Boost.Asio

Filename

microbind.exe mimikatz.exe fscan.exe powershell.exe cmd.exe svchost.exe notepad.exe mstsc.exe +13 more

SHA-256 Hash

F7F6D0AFB300B57C32853D49FF50650F5D1DC7CF8111AA32FF658783C038BFE5 DD832C8E30ED50383495D370836688EE48E95334270CBBCE41109594CB0C9FD1 F7B52EE613F8D4E55A69F0B93AA9AA5472E453B0C458C8390DB963FF8B0B769C 6F6F7AA6144A1CFE61AC0A80DB7AD712440BDC5730644E05794876EB8B6A41B4 BAB01D029556CF6290F6F21FEC5932E13399F93C5FDBCFFD3831006745F0EB83 497A326C6C207C1FB49E4DAD81D051FCF6BCBE047E0D3FE757C298EF8FE99ABA F9EB34C34E4A91630F265F12569F70B83FEBA039C861D6BF906B74E7FB308648

IPv4 Address

217.15.160.247 217.15.164.147 95.182.100.231 194.233.92.26

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (7)

M1018 User Account Management M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program +2 more

Installation (16)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management +11 more

Command & Control (8)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1032 Multi-factor Authentication +3 more

Actions on Objectives (16)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +11 more

Detection Coverage

18 strategies

5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0309 Compromised software/update chain (insta...

Exploitation (2)

DET0364 Behavioral Detection Strategy for WMI Ex... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (8)

DET0085 Credential Dumping from SAM via Registry... DET0179 Behavioral Detection of Permission Group... DET0234 Credential Dumping via Sensitive Memory... DET0357 Behavioral Detection of Internet Connect... DET0376 Behavioral Detection Strategy for Networ... +3 more

Command & Control (2)

DET0327 Multi-event Detection Strategy for RDP-B... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (4)

DET0081 Detection of Proxy Execution via Trusted... DET0087 Encrypted or Encoded File Payload Detect... DET0280 Behavior-Based Registry Modification Det... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UAT-5918

Type: Unknown Active

tracked as

Infrastructure 12 IOC(s)

50%

Domain

groups.There Snort.org wmiexec.py Unix.Backdoor Unix.Backdoor.Agent +3

IPv4 Address

217.15.160.247 217.15.164.147 95.182.100.231 194.233.92.26

Artifacts (28)

microbind.exe mimikatz.exe fscan.exe powershell.exe cmd.exe svchost.exe +22

Capability

50%

18 technique(s) 59 tool(s)/malware 7 CVE(s)

AppDomainManager BITS Backdoors Browser credential stealers Chopper web shell Cobalt Custom malware DOGLEASH +51

credential access

T1003 T1003.002 T1555.005

defense impairment

T1112

discovery

T1016.001 T1046 T1069 T1082

execution

T1047 T1059.001

Victim

70%

Targeted Sectors

critical-infrastructure government telecommunications healthcare defense information-technology utilities

Targeted Countries

TW CN US GB DE IT IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1195.002

Capability (Malware)

AppDomainManager BITS Backdoors

Infrastructure

groups.There Snort.org wmiexec.py

4 Exploitation

Capability (Techniques)

T1047 T1059.001

Capability (Malware)

AppDomainManager BITS Backdoors

Infrastructure

groups.There Snort.org wmiexec.py

5 Installation

Capability (Techniques)

T1003 T1003.002 T1555.005 T1016.001 T1046

Capability (Malware)

AppDomainManager BITS Backdoors

Infrastructure

groups.There Snort.org wmiexec.py

6 Command & Control

Capability (Techniques)

T1021.001 T1021.004

Capability (Malware)

AppDomainManager BITS Backdoors

Infrastructure

groups.There Snort.org wmiexec.py