Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNK_FistBump (threat actor)

Risk

Critical

10 techniques 56 tools/malware 11 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059.003

Windows Command Shell execution

T1059.004

Unix Shell execution

T1203

Exploitation for Client Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2018-0171

CVE CVE-2021-4034

CVE CVE-2023-34048

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-8088

›

5 Installation

T1120

Peripheral Device Discovery discovery

›

6 Command & Control

No data

›

7 Actions on Objectives

T1036

Masquerading stealth

T1055.004

Asynchronous Procedure Call stealth

Stage risk: Critical High Medium None

Tools & Malware (56)

Babylon RAT Backdoors Beacon Charon Cisco Smart Install vulnerability (CVE-2018-0171) ClickFix Cobalt Cobalt Strike Cobalt Strike BEACON Custom malware DCRat DumpIt Fake ChatGPT client GitHub Global Gunra Interlock Interlock ransomware Leverage MINIBIKE Microsoft Help Index File loader MiniBrowse stealer MiniJunk Mythic agent Nimbus Manticore Payload Payload PhantomCore Phishing campaigns Phishing emails PipeMagic PlugX PlugX variant Poseidon backdoor PowerShell PureHVNC RAT RustyClaw Sliver SnipBot variant Spear-phishing Spear-phishing Campaigns Subtle Snail Trojanized Rufus loader Unknown UpCrypter dropper Volatility Voldemort Voldemort Backdoor WarLock Web Shell Web Shells Wevtutil WinRAR exploit Winrar phishing wmic

Indicators of Compromise (40)

Domain

BI.ZONE ASP.NET rc4.log SSL.com elliot-alderson-971.pserver.space thehackernews.com ema.moctw.info

Filename

jli.dll srunas.exe appcmd.exe CiscoSparkLauncher.dll python20.dll hpp.bat hp.bat CiscoCollabHost.exe +17 more

IPv4 Address

80.85.156.237 45.141.139.222 166.88.61.35 80.85.156.234 82.118.16.72 80.85.154.48 80.85.154.101

URL

http://api.moctw.info/Intro.pdf

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (8)

M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Actions on Objectives (8)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

10 strategies

4/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0364 Behavioral Detection Strategy for WMI Ex... DET0384 Behavioral Detection of Unix Shell Execu... DET0514 Detection Strategy for Exploitation for...

Installation (1)

DET0491 Peripheral Device Enumeration via System...

Actions on Objectives (2)

DET0100 Behavioral Detection of Asynchronous Pro... DET0127 Behavioral Detection of Masquerading Acr...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNK_FistBump

Type: Unknown Active

manufacturing YoroTrooper SturgeonPhisher Silent Lynx tracked as +36 more

Infrastructure 15 IOC(s)

50%

Domain

BI.ZONE ASP.NET rc4.log SSL.com elliot-alderson-971.pserver.space +2

IPv4 Address

80.85.156.237 45.141.139.222 166.88.61.35 80.85.156.234 82.118.16.72 +2

URL

http://api.moctw.info/Intro.pdf

Artifacts (25)

jli.dll srunas.exe appcmd.exe CiscoSparkLauncher.dll python20.dll hpp.bat +19

Capability

50%

10 technique(s) 56 tool(s)/malware 11 CVE(s)

Babylon RAT Backdoors Beacon Charon Cisco Smart Install vulnerability (CVE-2018-0171) ClickFix Cobalt Cobalt Strike +48

discovery

T1120

execution

T1047 T1059.003 T1059.004 T1203

initial access

T1190 T1566.001

privilege escalation

T1068

Victim

70%

Targeted Sectors

manufacturing financial-services telecommunications government defense education transportation critical-infrastructure healthcare aerospace retail aviation utilities energy oil-gas food-agriculture construction media mining entertainment pharmaceutical legal-services hospitality think-tank

Targeted Countries

TW CN RU US BY SG KZ BR CA VN TR JP GB AU EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Babylon RAT Backdoors Beacon

Infrastructure

BI.ZONE ASP.NET rc4.log

4 Exploitation

Capability (Techniques)

T1047 T1059.003 T1059.004 T1203 T1068

Capability (Malware)

Babylon RAT Backdoors Beacon

Infrastructure

BI.ZONE ASP.NET rc4.log

5 Installation

Capability (Techniques)

T1120

Capability (Malware)

Babylon RAT Backdoors Beacon

Infrastructure

BI.ZONE ASP.NET rc4.log