Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

WARP PANDA (threat actor)

Risk

Critical

10 techniques 44 tools/malware 14 vulnerabilities 30 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-6065

CVE CVE-2021-22005

CVE CVE-2021-26084

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-26318

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2024-3721

CVE CVE-2024-40711

CVE CVE-2024-40766

›

5 Installation

T1083

File and Directory Discovery discovery

›

6 Command & Control

T1071.001

Web Protocols command and control

T1090

Proxy command and control

T1090.001

Internal Proxy command and control

T1090.002

External Proxy command and control

T1090.003

Multi-hop Proxy command and control

T1090.004

Domain Fronting command and control

T1572

Protocol Tunneling command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1140

Deobfuscate/Decode Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (44)

Akira AnyDesk BADAUDIO BRICKSTORM BRICKSTORM backdoor C2 infrastructure Cobalt Cobalt Strike Custom malware DragonBreath Duqu GalaxyGato GitHub GlassWorm Global GoRed HiddenFace Junction Leverage MuddyWater Mythic Nexus Pay2Key Payload Payload PhantomVAI Phishing emails PowerShell QakBot ReGeorg Red Likho Sharp7Extend SocGholish Spear-phishing Stuxnet Turla UNC1549 Unknown VBShower Void Warp ngrok phishing plink

Indicators of Compromise (30)

Domain

SqlUnicorn.Core wmiexec.py NTDS.dit Teleport.sh trycloudflare.com demo-cloud.space W32.Duqu TEMP.Veles +10 more

Email Address

press@crowdstrike.com ics-cert@kaspersky.com

Filename

SRManager.exe eskle.sys MSBuild.exe Version.dll conhost.exe sshd.exe plink.exe MMpLics.dll +2 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

4 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (3)

M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1031 Network Intrusion Prevention M1057 Data Loss Prevention

Detection Coverage

10 strategies

3/7 stages covered

Installation (1)

DET0370 Recursive Enumeration of Files and Direc...

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0075 Internal Proxy Behavior via Lateral Host... DET0196 Domain Fronting Behavior via Mismatched... DET0325 External Proxy Behavior via Outbound Rel... DET0359 Multi-hop Proxy Behavior via Relay Node... +2 more

Actions on Objectives (2)

DET0275 Detect Adversary Deobfuscation or Decodi... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

WARP PANDA

Type: Unknown Active

Storm-0978 Tropical Scorpius tracked as UTA0178 Red Dev 61 +30 more

Infrastructure 18 IOC(s)

50%

Domain

SqlUnicorn.Core wmiexec.py NTDS.dit Teleport.sh trycloudflare.com +13

Artifacts (12)

press@crowdstrike.com ics-cert@kaspersky.com SRManager.exe eskle.sys MSBuild.exe Version.dll +6

Capability

50%

10 technique(s) 44 tool(s)/malware 14 CVE(s)

Akira AnyDesk BADAUDIO BRICKSTORM BRICKSTORM backdoor C2 infrastructure Cobalt Cobalt Strike +36

command and control

T1071.001 T1090 T1090.001 T1090.002 +3

discovery

T1083

exfiltration

T1041

stealth

T1140

Victim

70%

Targeted Sectors

government defense financial-services manufacturing transportation energy critical-infrastructure aerospace education healthcare food-agriculture construction information-technology pharmaceutical chemical retail telecommunications media utilities aviation maritime hospitality gaming oil-gas entertainment

Targeted Countries

CN US RU UA TW JP IN BY IL IR SA EG FR CA GB DE BR MX KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

5 Installation

Capability (Techniques)

T1083

Capability (Malware)

Akira AnyDesk BADAUDIO

Infrastructure

SqlUnicorn.Core wmiexec.py NTDS.dit

6 Command & Control

Capability (Techniques)

T1071.001 T1090 T1090.001 T1090.002 T1090.003

Capability (Malware)

Akira AnyDesk BADAUDIO

Infrastructure

SqlUnicorn.Core wmiexec.py NTDS.dit

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Akira AnyDesk BADAUDIO

Infrastructure

SqlUnicorn.Core wmiexec.py NTDS.dit