Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Ruthless Rabbit (threat actor)

Risk

High

9 techniques 58 tools/malware 2 vulnerabilities 21 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1204

User Execution execution

T1204.002

Malicious File execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2015-1701

CVE CVE-2026-50522

›

5 Installation

No data

›

6 Command & Control

T1071.003

Mail Protocols command and control

T1021

Remote Services lateral movement

›

7 Actions on Objectives

T1193

Stage risk: Critical High Medium None

Tools & Malware (58)

Anchor Brute Ratel C4 Buhtrap CloudDuke Cobalt CosmicDuke CozyDuke Crocodilus DEADEYE Dark DarkHotel ELMER GeminiDuke Ghost RAT Global HammerDuke Hammertoss Hellsing Hidden Cobra Hive IRONHALO Jackal Lynx Matrix MiniDionis MiniDuke Mirage Mythic Naikon Nefilim Nexus Nitro Noodlophile OnionDuke Phishing campaigns Phishing emails PinchDuke Poseidon Predator RokRAT SEXi SUNBURST Sabre Samurai SeaDuke Shamoon Shark Spear-phishing Stuxnet TeamSpy Trojan Tsunami Turla VICEROY Void WhatsApp gcman phishing

Indicators of Compromise (21)

Domain

demo-cloud.space attack.mitre.org reserved.FeedbackWebsite TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo +13 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Exploitation (10)

M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation +5 more

Command & Control (8)

M1018 User Account Management M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network +3 more

Detection Coverage

8 strategies

3/7 stages covered

Delivery (3)

DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0294 User Execution – Malicious File via down... DET0478 User Execution – multi-surface behavior... DET0514 Detection Strategy for Exploitation for...

Command & Control (2)

DET0135 Detection of Mail Protocol-Based C2 Acti... DET0269 Behavioral Detection Strategy for Remote...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Ruthless Rabbit

Type: Unknown Active

tracked as the Newscaster Team Extreme' characters Chatty Spider Luna Moth +19 more

Infrastructure 21 IOC(s)

50%

Domain

demo-cloud.space attack.mitre.org reserved.FeedbackWebsite TEMP.Hermit TEMP.Veles +16

Capability

50%

9 technique(s) 58 tool(s)/malware 2 CVE(s)

Anchor Brute Ratel C4 Buhtrap CloudDuke Cobalt CosmicDuke CozyDuke Crocodilus +50

T1193

command and control

T1071.003

execution

T1204 T1204.002

initial access

T1189 T1566.001 T1566.002

Victim

70%

Targeted Sectors

government defense financial-services non-profit media energy telecommunications aerospace education manufacturing information-technology maritime think-tank healthcare pharmaceutical utilities nuclear chemical mining hospitality legal-services entertainment

Targeted Countries

US CN GB IN JP DE IR KR TW RU SA CA TR FR AU IL KZ PK SG VN UA PL ES RO AE NL BR IQ BY AZ IT SY MX KP EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001 T1566.002

Capability (Malware)

Anchor Brute Ratel C4 Buhtrap

Infrastructure

demo-cloud.space attack.mitre.org reserved.FeedbackWebsite

4 Exploitation

Capability (Techniques)

T1204 T1204.002 T1068

Capability (Malware)

Anchor Brute Ratel C4 Buhtrap

Infrastructure

demo-cloud.space attack.mitre.org reserved.FeedbackWebsite

6 Command & Control

Capability (Techniques)

T1071.003 T1021

Capability (Malware)

Anchor Brute Ratel C4 Buhtrap

Infrastructure

demo-cloud.space attack.mitre.org reserved.FeedbackWebsite