Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Crimson Collective (threat actor)

Risk

Critical

40 techniques 43 tools/malware 9 vulnerabilities 26 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589.002

Email Addresses reconnaissance

T1593

Search Open Websites/Domains reconnaissance

T1595

Active Scanning reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.005

Visual Basic execution

T1059.006

Python execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

T1068

Exploitation for Privilege Escalation privilege escalation

T1548

Abuse Elevation Control Mechanism privilege escalation

CVE CVE-2023-20198

CVE CVE-2025-14847

CVE CVE-2025-20393

CVE CVE-2025-68615

CVE CVE-2025-68664

CVE CVE-2026-33032

CVE CVE-2026-41940

CVE CVE-2026-55040

CVE CVE-2026-63030

›

5 Installation

T1003.002

Security Account Manager credential access

T1003.003

NTDS credential access

T1003.005

Cached Domain Credentials credential access

T1069.003

Cloud Groups discovery

T1087.004

Cloud Account discovery

T1526

Cloud Service Discovery discovery

T1580

Cloud Infrastructure Discovery discovery

T1619

Cloud Storage Object Discovery discovery

T1136.003

Cloud Account persistence

T1505

Server Software Component persistence

›

6 Command & Control

T1074.002

Remote Data Staging collection

T1213.003

Code Repositories collection

T1530

Data from Cloud Storage collection

T1219

Remote Access Tools command and control

T1021.007

Cloud Services lateral movement

›

7 Actions on Objectives

T1556

Modify Authentication Process defense impairment

T1556.006

Multi-Factor Authentication defense impairment

T1578.001

Create Snapshot defense impairment

T1578.002

Create Cloud Instance defense impairment

T1578.005

Modify Cloud Compute Configurations defense impairment

T1567

Exfiltration Over Web Service exfiltration

T1070.003

Clear Command History stealth

T1078

Valid Accounts stealth

T1078.004

Cloud Accounts stealth

T1070.001

T1562.001

Stage risk: Critical High Medium None

Tools & Malware (43)

AdWind Akira AnyDesk BlueSky Crimson Dark Expand Firefox GitHub Global Gootloader Hive Infostealer Langflow Leverage MeowBackConn MgBot Momentum Money Message Payload Payload Phishing campaigns PowerShell PowerShell commands PowerShell scripts PsExec Python scripts Qilin Rhysida STOP SocGholish Softr Telegram Telegram channels TruffleHog Unknown WinRM ZLib mshta mshta.exe phishing rhysida Ransomware route

Indicators of Compromise (26)

Domain

Infostealer.Win.MgBot amazonaws.com ntds.dit workmail.amazonaws.com ses.amazonaws.com workmail.us-east-1.amazonaws.com malicious-organiation.com email.message +6 more

Email Address

support@vectra.ai marketing@malicious-organiation.com service@ipad-service-london.com marketing@ipad-service-london.com

Filename

mshta.exe

IPv4 Address

3.215.23.185 54.151.176.0 139.59.117.125 45.148.10.141 3.0.205.202 195.201.175.210 5.9.108.250

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

38 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (3)

M1013 Application Developer Guidance M1047 Audit M1056 Pre-compromise

Delivery (14)

M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more

Exploitation (19)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more

Installation (14)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1024 Restrict Registry Permissions M1026 Privileged Account Management +9 more

Command & Control (12)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1031 Network Intrusion Prevention +7 more

Actions on Objectives (17)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +12 more

Detection Coverage

38 strategies

6/7 stages covered

Reconnaissance (3)

DET0814 Detection of Email Addresses DET0830 Detection of Active Scanning DET0856 Detection of Search Open Websites/Domain...

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (8)

DET0063 Cross-Platform Behavioral Detection of P... DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0294 User Execution – Malicious File via down... DET0345 Detection Strategy for Abuse Elevation C... +3 more

Installation (10)

DET0085 Credential Dumping from SAM via Registry... DET0169 Detection Strategy for Cloud Infrastruct... DET0251 Behavioral Detection of Cloud Group Enum... DET0319 Detection Strategy for T1136.003 - Cloud... DET0386 Cloud Account Enumeration via API, CLI,... +5 more

Command & Control (5)

DET0008 Behavioral Detection of Remote Cloud Log... DET0071 Detection of Remote Data Staging Prior t... DET0263 Detecting Bulk or Anomalous Access to Pr... DET0484 Multi-Platform Cloud Storage Exfiltratio... DET0496 Behavior-Chain Detection for Remote Acce...

Actions on Objectives (9)

DET0104 Detect Modification of Authentication Pr... DET0165 Behavioral Detection of Command History... DET0190 Detect MFA Modification or Disabling Acr... DET0423 Detection Strategy for Modify Cloud Comp... DET0449 Detection Strategy for Modify Cloud Comp... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Crimson Collective

Type: Unknown Active

CryptoChameleon Octo Tempest UNC3944 tracked as hold it for ransom +3 more

Infrastructure 21 IOC(s)

50%

Domain

Infostealer.Win.MgBot amazonaws.com ntds.dit workmail.amazonaws.com ses.amazonaws.com +9

IPv4 Address

3.215.23.185 54.151.176.0 139.59.117.125 45.148.10.141 3.0.205.202 +2

Artifacts (5)

support@vectra.ai marketing@malicious-organiation.com service@ipad-service-london.com marketing@ipad-service-london.com mshta.exe

Capability

50%

40 technique(s) 43 tool(s)/malware 9 CVE(s)

AdWind Akira AnyDesk BlueSky Crimson Dark Expand Firefox +35

T1070.001 T1562.001

collection

T1074.002 T1213.003 T1530

command and control

T1219

credential access

T1003.002 T1003.003 T1003.005

Victim

70%

Targeted Sectors

financial-services healthcare hospitality defense telecommunications retail media aviation government education manufacturing

Targeted Countries

US FR JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.002 T1593 T1595

Capability (Malware)

AdWind Akira AnyDesk

Infrastructure

Infostealer.Win.MgBot amazonaws.com ntds.dit

3 Delivery

Capability (Techniques)

T1189 T1190 T1566

Capability (Malware)

AdWind Akira AnyDesk

Infrastructure

Infostealer.Win.MgBot amazonaws.com ntds.dit

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.005 T1059.006 T1204.001

Capability (Malware)

AdWind Akira AnyDesk

Infrastructure

Infostealer.Win.MgBot amazonaws.com ntds.dit

5 Installation

Capability (Techniques)

T1003.002 T1003.003 T1003.005 T1069.003 T1087.004

Capability (Malware)

AdWind Akira AnyDesk

Infrastructure

Infostealer.Win.MgBot amazonaws.com ntds.dit

6 Command & Control

Capability (Techniques)

T1074.002 T1213.003 T1530 T1219 T1021.007

Capability (Malware)

AdWind Akira AnyDesk

Infrastructure

Infostealer.Win.MgBot amazonaws.com ntds.dit

7 Actions on Objectives

Capability (Techniques)

T1567

Capability (Malware)

AdWind Akira AnyDesk

Infrastructure

Infostealer.Win.MgBot amazonaws.com ntds.dit