Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Houken (threat actor)

Risk

High

5 techniques 42 tools/malware 8 vulnerabilities 10 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2024-8190

CVE CVE-2024-8963

CVE CVE-2024-9380

CVE CVE-2024-9381

CVE CVE-2025-20281

CVE CVE-2025-20282

CVE CVE-2025-20337

CVE CVE-2025-6558

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041 Exfiltration Over Command and Control Channel

T1059.001 PowerShell

T1060 Create or Modify System Process (rootkit)

T1203 Exploit Public-Facing Application

T1491.001 System Resource Hijacking: Cryptomining

Stage risk: Critical High Medium None

Tools & Malware (42)

Akira Akira ransomware Alien ApolloShadow BLINDINGCAN BeaverTail BianLian Bulletproof hosting Bulletproof hosting services Crisis Ghost RAT Global Google Drive Guard HellCat Ransomware Hide and Seek Hunters International Infostealer Invisible Ferret InvisibleFerret Leverage Matryoshka Milan Open-source tools Persistence mechanisms PowerShell PowerShell commands PowerShell scripts RedLine Resident Rhadamanthys Rootkit Scheduled Task manipulation Scheduled Tasks Trojan Turla Unknown ValleyRAT XORIndex Loader XRed npm packages phishing

Indicators of Compromise (10)

Domain

user.XML demo-cloud.space info.gouv.fr cyber.gouv.fr service-public.fr legifrance.gouv.fr france.fr pastesio.com +1 more

Email Address

services@cert.europa.eu

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Houken

Type: Unknown Active

Synaptics worm Hou Ken Scattered Spider

Infrastructure 9 IOC(s)

50%

Domain

user.XML demo-cloud.space info.gouv.fr cyber.gouv.fr service-public.fr +4

Artifacts (1)

services@cert.europa.eu

Capability

50%

5 technique(s) 42 tool(s)/malware 8 CVE(s)

Akira Akira ransomware Alien ApolloShadow BLINDINGCAN BeaverTail BianLian Bulletproof hosting +34

T1041 Exfiltration Over Command and Control Channel T1059.001 PowerShell T1060 Create or Modify System Process (rootkit) T1203 Exploit Public-Facing Application +1

Victim

70%

Targeted Sectors

government telecommunications media financial-services critical-infrastructure defense non-profit healthcare aerospace aviation manufacturing education think-tank nuclear energy transportation retail

Targeted Countries

CN RU US FR TW GB IN IR IL SA UA PK

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges