Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Jabaroot (threat actor)

Risk

Critical

7 techniques 41 tools/malware 7 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

CVE CVE-2024-11859

CVE CVE-2024-50623

CVE CVE-2024-53197

CVE CVE-2025-29824

CVE CVE-2025-30401

CVE CVE-2025-6554

CVE CVE-2026-63077

›

5 Installation

T1083

File and Directory Discovery discovery

›

6 Command & Control

T1071.001

Web Protocols command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1048

Exfiltration Over Alternative Protocol exfiltration

T1036.003

Rename Legitimate Utilities stealth

T1055.002

Portable Executable Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (41)

APT38 AdWind BLINDINGCAN BirdCall Bumblebee Clop Crisis Dark Emotet Gh0st Gh0st RAT Ghost RAT Global Havex RAT Kimsuky Leverage Matrix Medusa Medusa Ransomware MedusaLocker Ninja Nitro OceanLotus ROKRAT RansomHouse Rook Royal SAGE SUNBURST SideWinder Silence SolarWinds TEARDROP Telegram Tiger RAT Trojan Tsunami WAVESHAPER gh0st RAT malware distribution phishing

Indicators of Compromise (39)

Domain

demo-cloud.space Ransomware.Win.Clop Ransomware.Wins.Clop Ransomware.Wins.Clop.ta journal.pone j.jep moroccoworldnews.com CSIDB.net +31 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

13 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (7)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic +2 more

Detection Coverage

7 strategies

4/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (1)

DET0370 Recursive Enumeration of Files and Direc...

Command & Control (1)

DET0027 Detection of Web Protocol-Based C2 Over...

Actions on Objectives (4)

DET0005 Renamed Legitimate Utility Execution wit... DET0106 Behavioral Detection of PE Injection via... DET0131 Behavioral Detection Strategy for Exfilt... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Jabaroot

Type: Unknown Active

Jabaroot DZ tracked as

Infrastructure 39 IOC(s)

50%

Domain

demo-cloud.space Ransomware.Win.Clop Ransomware.Wins.Clop Ransomware.Wins.Clop.ta journal.pone +34

Capability

50%

7 technique(s) 41 tool(s)/malware 7 CVE(s)

APT38 AdWind BLINDINGCAN BirdCall Bumblebee Clop Crisis Dark +33

command and control

T1071.001

discovery

T1083

exfiltration

T1041 T1048

initial access

T1190

Victim

70%

Targeted Sectors

government defense telecommunications media financial-services non-profit education construction healthcare manufacturing hospitality energy critical-infrastructure transportation

Targeted Countries

US RU PK IN UA GB AU DE FR AE KP VN IR IL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

APT38 AdWind BLINDINGCAN

Infrastructure

demo-cloud.space Ransomware.Win.Clop Ransomware.Wins.Clop

5 Installation

Capability (Techniques)

T1083

Capability (Malware)

APT38 AdWind BLINDINGCAN

Infrastructure

demo-cloud.space Ransomware.Win.Clop Ransomware.Wins.Clop

6 Command & Control

Capability (Techniques)

T1071.001

Capability (Malware)

APT38 AdWind BLINDINGCAN

Infrastructure

demo-cloud.space Ransomware.Win.Clop Ransomware.Wins.Clop

7 Actions on Objectives

Capability (Techniques)

T1041 T1048

Capability (Malware)

APT38 AdWind BLINDINGCAN

Infrastructure

demo-cloud.space Ransomware.Win.Clop Ransomware.Wins.Clop