Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UTA0355 (threat actor)

Risk

Critical

8 techniques 43 tools/malware 11 vulnerabilities 31 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1204

User Execution execution

CVE CVE-2017-11882

CVE CVE-2019-0708

CVE CVE-2024-43451

CVE CVE-2024-58136

CVE CVE-2025-22457

CVE CVE-2025-24054

CVE CVE-2025-31200

CVE CVE-2025-31201

CVE CVE-2025-31324

CVE CVE-2025-32432

CVE CVE-2026-20230

›

5 Installation

T1087

Account Discovery discovery

T1098.005

Device Registration persistence

›

6 Command & Control

T1071.001

Web Protocols command and control

T1550

Use Alternate Authentication Material lateral movement

›

7 Actions on Objectives

T1193

Stage risk: Critical High Medium None

Tools & Malware (43)

AdWind Browser In Brute Ratel CHINACHOPPER CastleRAT ClickFix Cobalt Crimson Crimson RAT Custom malware Dark Device code phishing EvilTokens Expand Ghost RAT GitHub Global Hafnium Havex RAT Microsoft Teams OilRig Phishing Kit Phishing campaigns PlugX PowerShell ROADTools ROADtools Rogue Sednit Social engineering tactics Sofacy Spear Phishing Campaigns Spear-phishing Telegram Trojan Unknown Visual Studio Code Void WhatsApp curl phishing roadrecon roadtx

Indicators of Compromise (31)

Domain

enterpriseregistration.windows.net demo-cloud.space BI.ZONE wistia.com write.as hunt.io world-nuclear-exhibition-paris.com wne-2025.com +18 more

Email Address

no-reply@google.com services@cert.europa.eu

Filename

xrpl.js

URL

http://login.microsoftonline.com/common/oauth2/authorize?redirect= http://127.0.0.1:9217/callback?code=1.ARsAIGLD9ki0FE63WmhS-KbgFENkvK5tmX

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +1 more

Installation (3)

M1018 User Account Management M1028 Operating System Configuration M1032 Multi-factor Authentication

Command & Control (9)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +4 more

Detection Coverage

7 strategies

4/7 stages covered

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0478 User Execution – multi-surface behavior...

Installation (2)

DET0036 Suspicious Device Registration via Entra... DET0587 Enumeration of User or Account Informati...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0338 Behavioral Detection Strategy for Use Al...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UTA0355

Type: Unknown Active

UTA0352 Midnight Blizzard tracked as APT28 Pawn Storm +11 more

Infrastructure 28 IOC(s)

50%

Domain

enterpriseregistration.windows.net demo-cloud.space BI.ZONE wistia.com write.as +21

URL

http://login.microsoftonline.com/common/oauth2/authorize?redirect= http://127.0.0.1:9217/callback?code=1.ARsAIGLD9ki0FE63WmhS-KbgFENkvK5tmX

Artifacts (3)

no-reply@google.com services@cert.europa.eu xrpl.js

Capability

50%

8 technique(s) 43 tool(s)/malware 11 CVE(s)

AdWind Browser In Brute Ratel CHINACHOPPER CastleRAT ClickFix Cobalt Crimson +35

T1193

command and control

T1071.001

discovery

T1087

execution

T1204

Victim

70%

Targeted Sectors

government non-profit media telecommunications defense financial-services healthcare education critical-infrastructure retail transportation manufacturing energy think-tank hospitality

Targeted Countries

UA US CN RU KP TW KR GB IR PK ES DE NL PL JP FR RO IL BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

AdWind Browser In Brute Ratel

Infrastructure

enterpriseregistration.windows.net demo-cloud.space BI.ZONE

4 Exploitation

Capability (Techniques)

T1204

Capability (Malware)

AdWind Browser In Brute Ratel

Infrastructure

enterpriseregistration.windows.net demo-cloud.space BI.ZONE

5 Installation

Capability (Techniques)

T1087 T1098.005

Capability (Malware)

AdWind Browser In Brute Ratel

Infrastructure

enterpriseregistration.windows.net demo-cloud.space BI.ZONE

6 Command & Control

Capability (Techniques)

T1071.001 T1550

Capability (Malware)

AdWind Browser In Brute Ratel

Infrastructure

enterpriseregistration.windows.net demo-cloud.space BI.ZONE