Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Reckless Rabbit (threat actor)

Risk

Critical

7 techniques 48 tools/malware 8 vulnerabilities 24 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

›

4 Exploitation

T1204

User Execution execution

CVE CVE-2014-3466

CVE CVE-2015-1701

CVE CVE-2021-26084

CVE CVE-2022-26134

CVE CVE-2022-37969

CVE CVE-2026-21858

CVE CVE-2026-42208

CVE CVE-2026-50522

›

5 Installation

T1003

OS Credential Dumping credential access

›

6 Command & Control

T1071.004

DNS command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (48)

Anchor BackConfig Buhtrap Charon CloudDuke Cobalt CosmicDuke CozyDuke DEADEYE Dark DarkHotel Ghost RAT Global HammerDuke Hellsing Hidden Cobra Hive Jackal Lynx Matrix MiniDuke Mirage Mythic Naikon Nexus Nitro OnionDuke Phishing campaigns Phishing emails Poseidon Predator RedAlpha Rogue Samurai SeaDuke Shamoon Shark Spear-phishing Stuxnet TeamSpy Trojan Tsunami Turla VICEROY Void WhatsApp gcman phishing

Indicators of Compromise (24)

Domain

demo-cloud.space cisa.gov reserved.FeedbackWebsite TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo +16 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

23 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (14)

M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more

Exploitation (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +1 more

Installation (9)

M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (4)

M1017 User Training M1040 Behavior Prevention on Endpoint M1047 Audit M1049 Antivirus/Antimalware

Detection Coverage

7 strategies

5/7 stages covered

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0478 User Execution – multi-surface behavior...

Installation (1)

DET0234 Credential Dumping via Sensitive Memory...

Command & Control (1)

DET0400 Behavioral Detection of DNS Tunneling an...

Actions on Objectives (1)

DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Reckless Rabbit

Type: Unknown Active

tracked as Information Technology Security CVE-2022-26134 cpyy APT3 +17 more

Infrastructure 24 IOC(s)

50%

Domain

demo-cloud.space cisa.gov reserved.FeedbackWebsite TEMP.Hermit TEMP.Veles +19

Capability

50%

7 technique(s) 48 tool(s)/malware 8 CVE(s)

Anchor BackConfig Buhtrap Charon CloudDuke Cobalt CosmicDuke CozyDuke +40

command and control

T1071.004

credential access

T1003

execution

T1204

initial access

T1189 T1190 T1566

Victim

70%

Targeted Sectors

government defense financial-services non-profit media energy telecommunications aerospace education information-technology maritime manufacturing think-tank healthcare pharmaceutical critical-infrastructure nuclear chemical mining utilities hospitality legal-services entertainment

Targeted Countries

US CN GB IN JP DE KR IR TW RU SA CA TR FR AU IL KZ PK SG VN UA PL ES RO AE NL BR IQ BY AZ IT SY MX KP EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1190 T1566

Capability (Malware)

Anchor BackConfig Buhtrap

Infrastructure

demo-cloud.space cisa.gov reserved.FeedbackWebsite

4 Exploitation

Capability (Techniques)

T1204

Capability (Malware)

Anchor BackConfig Buhtrap

Infrastructure

demo-cloud.space cisa.gov reserved.FeedbackWebsite

5 Installation

Capability (Techniques)

T1003

Capability (Malware)

Anchor BackConfig Buhtrap

Infrastructure

demo-cloud.space cisa.gov reserved.FeedbackWebsite

6 Command & Control

Capability (Techniques)

T1071.004

Capability (Malware)

Anchor BackConfig Buhtrap

Infrastructure

demo-cloud.space cisa.gov reserved.FeedbackWebsite