Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GTG-1002 (threat actor)

Risk

Critical

17 techniques 45 tools/malware 13 vulnerabilities 2 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1588

Obtain Capabilities resource development

T1608

Stage Capabilities resource development

›

3 Delivery

T1566

Phishing initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1203

Exploitation for Client Execution execution

T1204

User Execution execution

T1559

Inter-Process Communication execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2012-0158

CVE CVE-2017-11882

CVE CVE-2018-0798

CVE CVE-2018-0802

CVE CVE-2021-1732

CVE CVE-2022-38028

CVE CVE-2023-48022

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

›

5 Installation

No data

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1095

Non-Application Layer Protocol command and control

T1105

Ingress Tool Transfer command and control

T1568

Dynamic Resolution command and control

T1573

Encrypted Channel command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1660

Stage risk: Critical High Medium None

Tools & Malware (45)

AvosLocker Backdoors BlackEnergy CVE-2012-0158 CVE-2017-11882 CaddyWiper Cobalt Cobalt Strike Conti Custom malware FrostyGoop FunnyDream GTG-1002 Malware GitHub Global Hermes Industroyer J-magic KillDisk Leverage Metasploit Framework Mobile malware Neo-reGeorg Nexus OilRig Open source tools Pikabot PlugX PuTTY ReGeorg Rogue STOP Scheduled Tasks Silence Skynet Solar SolarWinds SolarWinds Toolkit Triton VersaMem web shell WhatsApp ZxxZ inter metasploit phishing

Indicators of Compromise (2)

Domain

TEMP.Veles

Email Address

privacy@clutch.security

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more

Exploitation (18)

M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content +13 more

Command & Control (6)

M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic +1 more

Actions on Objectives (8)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

16 strategies

5/7 stages covered

Weaponization (3)

DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Exploitation (5)

DET0094 Cross-Platform Behavioral Detection of S... DET0287 Exploitation for Client Execution – cros... DET0478 User Execution – multi-surface behavior... DET0493 Detect Abuse of Inter-Process Communicat... DET0514 Detection Strategy for Exploitation for...

Command & Control (5)

DET0039 Detection Strategy for Dynamic Resolutio... DET0060 Detect Ingress Tool Transfers via Behavi... DET0273 Detection Strategy for Encrypted Channel... DET0444 Detection of Command and Control Over Ap... DET0457 Detection of Non-Application Layer Proto...

Actions on Objectives (2)

DET0127 Behavioral Detection of Masquerading Acr... DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GTG-1002

Type: Unknown Active

tracked as STATIC TUNDRA also tracked as Sandwo CovertNetwork-1658 the 7777 Botnet +2 more

Infrastructure 1 IOC(s)

50%

Domain

TEMP.Veles

Artifacts (1)

privacy@clutch.security

Capability

50%

17 technique(s) 45 tool(s)/malware 13 CVE(s)

AvosLocker Backdoors BlackEnergy CVE-2012-0158 CVE-2017-11882 CaddyWiper Cobalt Cobalt Strike +37

T1660

command and control

T1071 T1095 T1105 T1568 +1

execution

T1053 T1203 T1204 T1559

initial access

T1566

Victim

70%

Targeted Sectors

government energy defense financial-services healthcare telecommunications critical-infrastructure aviation maritime manufacturing transportation education information-technology media chemical think-tank aerospace construction oil-gas hospitality non-profit nuclear legal-services

Targeted Countries

CN UA US IN JP PK AU IR RU KR GB SA PL CA SG VN TW DE KZ IL TR FR BR MX ES IT KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1588 T1608

Capability (Malware)

AvosLocker Backdoors BlackEnergy

Infrastructure

TEMP.Veles

3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

AvosLocker Backdoors BlackEnergy

Infrastructure

TEMP.Veles

4 Exploitation

Capability (Techniques)

T1053 T1203 T1204 T1559 T1068

Capability (Malware)

AvosLocker Backdoors BlackEnergy

Infrastructure

TEMP.Veles

6 Command & Control

Capability (Techniques)

T1071 T1095 T1105 T1568 T1573

Capability (Malware)

AvosLocker Backdoors BlackEnergy

Infrastructure

TEMP.Veles