Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

HIVE-0145 (threat actor)

Risk

High

5 techniques 41 tools/malware 4 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2014-6352

CVE CVE-2022-42475

CVE CVE-2024-3400

CVE CVE-2026-63077

›

5 Installation

T1012

Query Registry discovery

›

6 Command & Control

T1071

Application Layer Protocol command and control

›

7 Actions on Objectives

T1542

Pre-OS Boot stealth

T5000

T9000

Stage risk: Critical High Medium None

Tools & Malware (41)

AcidRain Akira Backdoor malware Backdoors BeaverTail Black Basta BlackByte Cobalt Cobalt Strike Conti Custom Backdoor Exaramel GitHub HiddenFace Hive Kimsuky LockBit Medusa Mimikatz Mobile malware MuddyWater Naikon OilRig PLAY Payload Payload Phishing emails PlugX PowerShell PowerShell backdoor Rootkit Shai-Hulud Shamoon SolarWinds Strela Stealer StrelaStealer TrickBot Trojan Turla Web Shell phishing

Indicators of Compromise (40)

Domain

demo-cloud.space Trojan.Karagany AdDisplay.Ashas DEADEYE.EMBED DEADEYE.APPEND LITTLELAMB.WOOLTEA Trojan-SMS.AndroidOS.Agent.ao Trojan-SMS.AndroidOS.FakeInst +14 more

Filename

cmd.exe Node.js enterprise-attack-v17.1-software.xlsx lcommute.exe net.exe mscorsvc.dll cipher.exe enterprise-attack-v18.1-analytics.xlsx +10 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

7 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (5)

M1026 Privileged Account Management M1035 Limit Access to Resource Over Network M1046 Boot Integrity M1047 Audit M1051 Update Software

Detection Coverage

3 strategies

3/7 stages covered

Installation (1)

DET0209 Detection of Registry Query for Environm...

Command & Control (1)

DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (1)

DET0278 Detection Strategy for T1542 Pre-OS Boot

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

HIVE-0145

Type: Unknown Active

Hive0145 tracked as Project Spy Cridex similar to Sliver +6 more

Infrastructure 22 IOC(s)

50%

Domain

demo-cloud.space Trojan.Karagany AdDisplay.Ashas DEADEYE.EMBED DEADEYE.APPEND +17

Artifacts (18)

cmd.exe Node.js enterprise-attack-v17.1-software.xlsx lcommute.exe net.exe mscorsvc.dll +12

Capability

50%

5 technique(s) 41 tool(s)/malware 4 CVE(s)

AcidRain Akira Backdoor malware Backdoors BeaverTail Black Basta BlackByte Cobalt +33

T5000 T9000

command and control

T1071

discovery

T1012

stealth

T1542

Victim

70%

Targeted Sectors

financial-services government defense telecommunications manufacturing energy healthcare education transportation critical-infrastructure media retail information-technology aerospace mining pharmaceutical aviation maritime chemical legal-services nuclear hospitality gaming

Targeted Countries

US DE UA ES RU GB BR KR CN PL IN AU MX CA JP IL TR SY TW IT SA IR FR VN SG AE NL AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

5 Installation

Capability (Techniques)

T1012

Capability (Malware)

AcidRain Akira Backdoor malware

Infrastructure

demo-cloud.space Trojan.Karagany AdDisplay.Ashas

6 Command & Control

Capability (Techniques)

T1071

Capability (Malware)

AcidRain Akira Backdoor malware

Infrastructure

demo-cloud.space Trojan.Karagany AdDisplay.Ashas