Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Larva-24010 (threat actor)

Risk

Medium

0 techniques 41 tools/malware 1 vulnerabilities 39 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2025-59287

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (41)

AppDomainManager BITS BLINDINGCAN Backdoors Dark Explorer Ghost RAT Global Group Policy Hook Interception Leverage Lynx MESHAGENT MSBuild Makop Matrix Msiexec NKNShell Netcat Nevada Nitro PowerShell Process Hollowing QuasarRAT Rogue Rootkit Rundll32 SAGE STOP SUNBURST Trojan Web Shell Windows Command Shell gs-netcat inter mshta netsh phishing sqlmap systemd

Indicators of Compromise (39)

Domain

demo-cloud.space telegra.ph GovInfo.gov MeshService64.pdb windows.sh microsoft.devq.workers.dev elp.big.frequencies.txt ST.VINCENT +10 more

Email Address

ctid@mitre.org

Filename

computerdefaults.exe cmstp.exe file.zip cached.exe services.exe eventvwr.exe fodhelper.exe slui.exe +7 more

MD5 Hash

60f153778e843fc04c6ab239ca650a89 2e9bf8bf256a0c60402e05d6f20c6e3d 0dfea610a526b0d458e84c6cd604b2ab 21067f677b8ac8d843a56cd2c19356ff 0696da5b242023308ad45c50666b2b96

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Larva-24010

Type: Unknown Active

tracked as Bladabindi the Newscaster Team High-Boiling Fraction CASRN Ratenjay

Infrastructure 18 IOC(s)

50%

Domain

demo-cloud.space telegra.ph GovInfo.gov MeshService64.pdb windows.sh +13

Artifacts (21)

ctid@mitre.org computerdefaults.exe cmstp.exe file.zip cached.exe services.exe +15

Capability

50%

41 tool(s)/malware 1 CVE(s)

AppDomainManager BITS BLINDINGCAN Backdoors Dark Explorer Ghost RAT Global +33

Victim

70%

Targeted Sectors

chemical food-agriculture energy financial-services government oil-gas manufacturing education construction media transportation defense healthcare utilities aerospace mining

Targeted Countries

US MX CN BR EG JP TR

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges