Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Cyber Alliance (threat actor)

Risk

Critical

24 techniques 44 tools/malware 12 vulnerabilities 19 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

CVE CVE-2018-0171

CVE CVE-2021-40539

CVE CVE-2023-50387

CVE CVE-2025-29824

CVE CVE-2025-43300

CVE CVE-2025-53770

CVE CVE-2025-54948

CVE CVE-2025-54987

CVE CVE-2025-6543

CVE CVE-2025-8088

CVE CVE-2025-8875

CVE CVE-2025-8876

›

5 Installation

T1033

System Owner/User Discovery discovery

T1083

File and Directory Discovery discovery

T1135

Network Share Discovery discovery

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1529

System Shutdown/Reboot impact

T1036.005

Match Legitimate Resource Name or Location stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1218.005

Mshta stealth

T1497.003

Time Based Checks stealth

T1033: System Owner/User Discovery

T1059.001: Command‑line Interface

T1083: File and Directory Discovery

T1135: Network Share Discovery

T1140: Deobfuscate/Decode Files or Information

T1190: Exploit Public-Facing Application

T1218.005: Mshta

T1485: Data Destruction

T1486: Data Encrypted for Impact

T1497.003: Time Based Checks

T1529: System Shutdown/Reboot

T1547.001: Registry Run Keys / Startup Folder

Stage risk: Critical High Medium None

Tools & Malware (44)

Akira Akira ransomware AnyDesk ApolloShadow AppleSeed BlackCat Cobalt Cobalt Strike Dark DevilsTongue Expand Explorer GitHub Global Kimsuky Leverage Mimikatz Phishing Kit Pink PipeMagic Puppet scripts (defoff.bat) Ransomware tools RedTail STOP SUNBURST ScreenConnect SentinelOne SolarWinds Sunburst TeamViewer Telegram Trigon ransomware Trigona Trigona ransomware Trojan Turla Unknown WannaCry WarLock WhatsApp Winrar defoff.bat mshta phishing

Indicators of Compromise (19)

Domain

demo-cloud.space Cyber.Anarchy.Squad ANY.RUN Trojan.BAT.TASKILL.AE Trojan.BAT.KILLAV.WLDP Trojan.BAT.KILLAV.WLDX Trojan.Win64.MHYPROTINST Cyver.io +1 more

Email Address

services@cert.europa.eu ctid@mitre.org

Filename

svchost.exe mshta.exe turnoff.bat defoff.bat rwdrv.sys TMBMSRV.exe hlpdrv.sys nt.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Installation (1)

M1028 Operating System Configuration

Actions on Objectives (8)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1032 Multi-factor Authentication M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

12 strategies

3/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (4)

DET0093 Behavioral Detection of User Discovery v... DET0182 Behavior-chain detection for T1135 Netwo... DET0365 Detect Registry and Startup Folder Persi... DET0370 Recursive Enumeration of Files and Direc...

Actions on Objectives (7)

DET0141 Detect Time-Based Evasion via Sleep, Tim... DET0146 Detection of Data Destruction Across Pla... DET0215 Detection of Multi-Platform File Encrypt... DET0275 Detect Adversary Deobfuscation or Decodi... DET0347 Detection Strategy for Masquerading via... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Cyber Alliance

Type: Unknown Active

AlphaVM AlphaV Secret Blizzard tracked as the Newscaster Team +5 more

Infrastructure 9 IOC(s)

50%

Domain

demo-cloud.space Cyber.Anarchy.Squad ANY.RUN Trojan.BAT.TASKILL.AE Trojan.BAT.KILLAV.WLDP +4

Artifacts (10)

services@cert.europa.eu ctid@mitre.org svchost.exe mshta.exe turnoff.bat defoff.bat +4

Capability

50%

24 technique(s) 44 tool(s)/malware 12 CVE(s)

Akira Akira ransomware AnyDesk ApolloShadow AppleSeed BlackCat Cobalt Cobalt Strike +36

T1033: System Owner/User Discovery T1059.001: Command‑line Interface T1083: File and Directory Discovery T1135: Network Share Discovery +8

discovery

T1033 T1083 T1135

impact

T1485 T1486 T1529

initial access

T1190

Victim

70%

Targeted Sectors

telecommunications government financial-services energy defense critical-infrastructure information-technology manufacturing healthcare education non-profit retail transportation

Targeted Countries

US RU RO CN BR DE GB UA IR NL FR KP CA TR ES IT JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Akira Akira ransomware AnyDesk

Infrastructure

demo-cloud.space Cyber.Anarchy.Squad ANY.RUN

5 Installation

Capability (Techniques)

T1033 T1083 T1135 T1547.001

Capability (Malware)

Akira Akira ransomware AnyDesk

Infrastructure

demo-cloud.space Cyber.Anarchy.Squad ANY.RUN

7 Actions on Objectives

Capability (Techniques)

T1485 T1486 T1529

Capability (Malware)

Akira Akira ransomware AnyDesk

Infrastructure

demo-cloud.space Cyber.Anarchy.Squad ANY.RUN