Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Operation ForumTroll (threat actor)

Risk

High

9 techniques 45 tools/malware 2 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1203

Exploitation for Client Execution execution

CVE CVE-2025-2783

CVE CVE-2025-2857

›

5 Installation

T1049

System Network Connections Discovery discovery

›

6 Command & Control

T1071.004

DNS command and control

›

7 Actions on Objectives

T1027.001

Binary Padding stealth

T1055.002

Portable Executable Injection stealth

T1078.004

Cloud Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (45)

3001 Aisuru AsyncRAT BlueNoroff CALENDAR CHINACHOPPER Careto Custom RAT (Unnamed) Custom malware Custom malware and tools Dante Dark Firefox FlexiSpy Formbook Gh0st Global GodRAT Hive JripBot Jripbot Kazuar Loki Malicious files Milan Mori Morpho PHOTO Payload Payload PerlBot Phishing emails Pink Remote access tools SUNBURST Silence Spear-phishing Stolen Certificate Signed Executables Trinper Backdoor Trojan Unknown Wild Neutron Winnti gh0st RAT phishing

Indicators of Compromise (39)

Domain

fb.length d.body.appendChild window.IntersectionObserverEntry.prototype es.forEach o.unobserve e.target e.intersectionRatio o.disconnect +24 more

Email Address

intelreports@kaspersky.com

Filename

hot-chics.avi.exe svchost.exe wscript.exe cmd.exe doc.scr

MD5 Hash

3ab66c37ffde5f1df36faf481c877a99

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (4)

M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (8)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +3 more

Detection Coverage

9 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros...

Installation (1)

DET0320 Detection of System Network Connections...

Command & Control (1)

DET0400 Behavioral Detection of DNS Tunneling an...

Actions on Objectives (4)

DET0106 Behavioral Detection of PE Injection via... DET0275 Detect Adversary Deobfuscation or Decodi... DET0546 Detection of Abused or Compromised Cloud... DET0553 Detection Strategy for Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Operation ForumTroll

Type: Unknown Active

TA558 Jripbot Facebook Twitter Microsoft +2 more

Infrastructure 32 IOC(s)

50%

Domain

fb.length d.body.appendChild window.IntersectionObserverEntry.prototype es.forEach o.unobserve +27

Artifacts (7)

intelreports@kaspersky.com hot-chics.avi.exe svchost.exe wscript.exe cmd.exe doc.scr +1

Capability

50%

9 technique(s) 45 tool(s)/malware 2 CVE(s)

3001 Aisuru AsyncRAT BlueNoroff CALENDAR CHINACHOPPER Careto Custom RAT (Unnamed) +37

command and control

T1071.004

discovery

T1049

execution

T1059.003 T1203

initial access

T1566.001

Victim

70%

Targeted Sectors

government financial-services media education manufacturing critical-infrastructure hospitality healthcare retail

Targeted Countries

AE RU US LB VN DE FR KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

3001 Aisuru AsyncRAT

Infrastructure

fb.length d.body.appendChild window.IntersectionObserverEntry.prototype

4 Exploitation

Capability (Techniques)

T1059.003 T1203

Capability (Malware)

3001 Aisuru AsyncRAT

Infrastructure

fb.length d.body.appendChild window.IntersectionObserverEntry.prototype

5 Installation

Capability (Techniques)

T1049

Capability (Malware)

3001 Aisuru AsyncRAT

Infrastructure

fb.length d.body.appendChild window.IntersectionObserverEntry.prototype

6 Command & Control

Capability (Techniques)

T1071.004

Capability (Malware)

3001 Aisuru AsyncRAT

Infrastructure

fb.length d.body.appendChild window.IntersectionObserverEntry.prototype