Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Hive0117 (threat actor)

Risk

High

7 techniques 43 tools/malware 22 vulnerabilities 40 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-0171

CVE CVE-2018-6065

CVE CVE-2021-26084

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-26318

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2024-3721

CVE CVE-2024-40711

CVE CVE-2024-40766

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-8088

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1027.010

Command Obfuscation stealth

T1056.007

T1562.010

Stage risk: Critical High Medium None

Tools & Malware (43)

Akira AnyDesk BADAUDIO Backdoors ClickFix Cobalt Cobalt Strike Conti Conti Ransomware DarkWatchman GalaxyGato GitHub Global GoRed Gunra Interlock MINIBIKE Malicious files MuddyWater Mythic Payload Payload PhantomCore PhantomVAI Phishing campaigns Phishing emails PipeMagic PowerShell Red Likho Sharp7Extend SocGholish Spear-phishing Subtle Snail Telegram Trojan UNC1549 Unknown VBShower Void WarLock Warlock ransomware Winrar phishing

Indicators of Compromise (40)

Domain

http.uri NTDS.dit BI.ZONE unpkg.com SSL.com 4ad74aab.cfd 4ad74aab.xyz Hunt.io +13 more

Email Address

ics-cert@kaspersky.com contact@cyber.gc.ca

Filename

conhost.exe dynwrapx.dll Version.dll MMpLics.dll 06.2025.zip 2025-5.vbe contract-2025-5.vbe application.vbe +8 more

IPv4 Address

103.153.157.33

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

11 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (4)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1047 Audit

Actions on Objectives (3)

M1024 Restrict Registry Permissions M1040 Behavior Prevention on Endpoint M1049 Antivirus/Antimalware

Detection Coverage

5 strategies

3/7 stages covered

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0441 Detection of Suspicious Scheduled Task C...

Actions on Objectives (2)

DET0280 Behavior-Based Registry Modification Det... DET0505 Detection Strategy for Command Obfuscati...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Hive0117

Type: Unknown Active

Storm-0978 Tropical Scorpius Smoke Sandstorm TA455 aviation +46 more

Infrastructure 22 IOC(s)

50%

Domain

http.uri NTDS.dit BI.ZONE unpkg.com SSL.com +16

IPv4 Address

103.153.157.33

Artifacts (18)

ics-cert@kaspersky.com contact@cyber.gc.ca conhost.exe dynwrapx.dll Version.dll MMpLics.dll +12

Capability

50%

7 technique(s) 43 tool(s)/malware 22 CVE(s)

Akira AnyDesk BADAUDIO Backdoors ClickFix Cobalt Cobalt Strike Conti +35

T1056.007 T1562.010

defense impairment

T1112

execution

T1053.005

initial access

T1566 T1566.001

Victim

70%

Targeted Sectors

government financial-services defense telecommunications manufacturing transportation critical-infrastructure energy aerospace education healthcare retail media food-agriculture aviation construction oil-gas information-technology entertainment utilities pharmaceutical chemical maritime mining legal-services hospitality

Targeted Countries

RU UA US CA IR BY CN KZ BR TW GB TR IT IL EG SG VN PL PK FR DE IN MX JP AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566 T1566.001

Capability (Malware)

Akira AnyDesk BADAUDIO

Infrastructure

http.uri NTDS.dit BI.ZONE

4 Exploitation

Capability (Techniques)

T1053.005

Capability (Malware)

Akira AnyDesk BADAUDIO

Infrastructure

http.uri NTDS.dit BI.ZONE