Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Curly COMrades (threat actor)

Risk

Critical

10 techniques 57 tools/malware 30 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1204.001

Malicious Link execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-0171

CVE CVE-2018-6065

CVE CVE-2021-26084

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-26318

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2024-3721

CVE CVE-2024-40711

CVE CVE-2024-40766

CVE CVE-2025-26633

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-43300

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-54948

CVE CVE-2025-54987

CVE CVE-2025-6218

CVE CVE-2025-6543

CVE CVE-2025-8088

CVE CVE-2025-8875

CVE CVE-2025-8876

CVE CVE-2026-50522

›

5 Installation

T1040

Network Sniffing credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

T1574.001

DLL stealth

T1574.004

Dylib Hijacking stealth

T1179

T1660

Stage risk: Critical High Medium None

Tools & Malware (57)

Akira BADAUDIO Backdoor.Syskit Backdoors C2 infrastructure Chrome update loader via DLL hijacking ClickFix Cobalt Cobalt Strike Custom malware Fake ChatGPT client (Rust/Tauri/Tokio) GalaxyGato GitHub Global GoRed Group Policy Hyper-V Infostealer/Sha.exe/Sha432.exe Infostealer/stereoversioncontrol.exe MINIBIKE Microsoft Help Index Loader MiniBrowse MiniJunk MuddyWater Mythic Mythic agent Payload Payload PhantomCore Phishing campaigns Phishing emails PipeMagic Poison Frog PowerShell Resocks RustyClaw Scheduled Tasks SnipBot SocGholish Spear-phishing Stunnel Subtle Snail Telegram Trend Micro fake updates UNC1549 Unknown Void WarLock Web Shells WhatsApp WinRAR Winrar curl curl.exe get-logon-history.ps1 phishing trojanized Rufus

Indicators of Compromise (40)

Domain

TaskLauncher.TaskHandler icon.png SSL.com ASP.NET index.png BI.ZONE service.conf System.Management.Automation +3 more

Email Address

ics-cert@kaspersky.com

Filename

GoogleUpdate.exe t.bat tbd.exe DRM.exe tstunnel.exe powershell.exe cmd.exe rundll32.exe +13 more

MD5 Hash

44a57a7c388af4d96771ab23e85b7f1e dc40b5c914e5f41a6b4bc19831c88892

IPv4 Address

194.87.31.171 45.43.91.10 75.127.13.136 96.30.124.103 91.107.174.190

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (8)

M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1038 Execution Prevention +3 more

Installation (4)

M1018 User Account Management M1030 Network Segmentation M1032 Multi-factor Authentication M1041 Encrypt Sensitive Information

Actions on Objectives (6)

M1013 Application Developer Guidance M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1044 Restrict Library Loading M1047 Audit +1 more

Detection Coverage

8 strategies

4/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0066 User Execution – Malicious Link (click →... DET0202 Behavioral Detection of Windows Command... DET0514 Detection Strategy for Exploitation for...

Installation (1)

DET0314 Detection Strategy for Network Sniffing...

Actions on Objectives (2)

DET0152 Detection Strategy for Hijack Execution... DET0201 Detection Strategy for Hijack Execution...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Curly COMrades

Type: Unknown Active

Storm-0978 Tropical Scorpius Smoke Sandstorm TA455 aviation +82 more

Infrastructure 16 IOC(s)

50%

Domain

TaskLauncher.TaskHandler icon.png SSL.com ASP.NET index.png +6

IPv4 Address

194.87.31.171 45.43.91.10 75.127.13.136 96.30.124.103 91.107.174.190

Artifacts (24)

ics-cert@kaspersky.com GoogleUpdate.exe t.bat tbd.exe DRM.exe tstunnel.exe +18

Capability

52%

10 technique(s) 57 tool(s)/malware 30 CVE(s)

Akira BADAUDIO Backdoor.Syskit Backdoors C2 infrastructure Chrome update loader via DLL hijacking ClickFix Cobalt +49

T1179 T1660

credential access

T1040

execution

T1059.003 T1204.001

initial access

T1190 T1566.001

Victim

70%

Targeted Sectors

telecommunications financial-services government manufacturing defense transportation energy education healthcare critical-infrastructure aerospace retail aviation food-agriculture construction media oil-gas utilities maritime entertainment mining pharmaceutical chemical information-technology non-profit legal-services hospitality

Targeted Countries

RU US UA CN BY CA BR IR KZ TW GB FR SG VN TR JP EG IL DE RO NL KP AU IN MX ES IT SA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Akira BADAUDIO Backdoor.Syskit

Infrastructure

TaskLauncher.TaskHandler icon.png SSL.com

4 Exploitation

Capability (Techniques)

T1059.003 T1204.001 T1068

Capability (Malware)

Akira BADAUDIO Backdoor.Syskit

Infrastructure

TaskLauncher.TaskHandler icon.png SSL.com

5 Installation

Capability (Techniques)

T1040

Capability (Malware)

Akira BADAUDIO Backdoor.Syskit

Infrastructure

TaskLauncher.TaskHandler icon.png SSL.com