Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GhostRedirector (threat actor)

Risk

Critical

34 techniques 51 tools/malware 12 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

T1583.004

Server resource development

T1587.001

Malware resource development

T1588.002

Tool resource development

T1588.003

Code Signing Certificates resource development

T1608.001

Upload Malware resource development

T1608.002

Upload Tool resource development

T1608.006

SEO Poisoning resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053.006

Systemd Timers execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1106

Native API execution

T1203

Exploitation for Client Execution execution

T1559

Inter-Process Communication execution

T1546

Event Triggered Execution privilege escalation

CVE CVE-2018-0171

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-43300

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53690

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-55177

CVE CVE-2025-6218

CVE CVE-2025-8088

›

5 Installation

T1012

Query Registry discovery

T1083

File and Directory Discovery discovery

›

6 Command & Control

T1008

Fallback Channels command and control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1219

Remote Access Tools command and control

T1534

Internal Spearphishing lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1565

Data Manipulation impact

T1027

Obfuscated Files or Information stealth

T1027.009

Embedded Payloads stealth

T1055.001

Dynamic-link Library Injection stealth

T1134

Access Token Manipulation stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1064

T1085

T1086

Stage risk: Critical High Medium None

Tools & Malware (51)

.NET Reactor Backdoors BadPotato BadPotato exploit Charon ClickFix Cobalt Custom tools EAGLET EfsPotato Gamshen Gentlemen Global GoToHTTP Gunra Interlock Interlock ransomware Leverage MINIBIKE MiniBrowse MiniJunk Mythic Nimbus Manticore Payload Payload PhantomCore Phishing campaigns Phishing emails PipeMagic PlugX Poseidon PowerShell PromptLock Remote access tools Rogue Rungan Rungan backdoor Subtle Snail Telegram Trojan Unknown WarLock Web Shell Webshells Winrar Zunput certutil.exe cmd.exe curl phishing rundll32.exe

Indicators of Compromise (39)

Domain

Webshell.UY 868id.com 5.97.0.mas.8d580ada.awus log.txt Common.Global.pdb ASP.NET Common.Global BI.ZONE +12 more

Filename

cmd.exe link.exe miniscreen.dll EfsNetAutoUser.exe sqlserver.exe ManagedEngine64.dll Common.Global.DLL MyDLL.dll +1 more

MD5 Hash

030201090405060708090A0B0C0D0E0F

SHA-1 Hash

21E877AB2430B72E3DB12881D878F78E0989BB7F 9DD282184DDFA796204C1D90A46CAA117F46C8E1 5A01981D3F31AF47614E51E6C216BED70D921D60 371818BDC20669DF3CA44BE758200872D583A3B8 871A4DF66A8BAC3E640B2D1C0AFC075BB3761954 28140A5A29EBA098BC6215DDAC8E56EACBB29B69 049C343A9DAAF3A93756562ED73375082192F5A8 BE2AC4A5156DBD9FFA7A9F053F8FA4AF5885BE3C +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (13)

M1013 Application Developer Guidance M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1038 Execution Prevention +8 more

Command & Control (5)

M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic M1038 Execution Prevention M1042 Disable or Remove Feature or Program

Actions on Objectives (11)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +6 more

Detection Coverage

31 strategies

6/7 stages covered

Weaponization (8)

DET0824 Detection of Upload Malware DET0834 Detection of Upload Tool DET0852 Detection of Tool DET0871 Detection of Server DET0872 Detection of Malware +3 more

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (7)

DET0010 Behavioral Detection of Event Triggered... DET0202 Behavioral Detection of Windows Command... DET0231 Behavioral Detection of Systemd Timer Ab... DET0287 Exploitation for Client Execution – cros... DET0455 Abuse of PowerShell for Arbitrary Execut... +2 more

Installation (2)

DET0209 Detection of Registry Query for Environm... DET0370 Recursive Enumeration of Files and Direc...

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0054 Internal Spearphishing via Trusted Accou... DET0060 Detect Ingress Tool Transfers via Behavi... DET0496 Behavior-Chain Detection for Remote Acce... DET0499 Behavioral Detection of Fallback or Alte...

Actions on Objectives (7)

DET0059 Detection Strategy for Data Manipulation DET0214 Detection Strategy for Embedded Payloads DET0275 Detect Adversary Deobfuscation or Decodi... DET0280 Behavior-Based Registry Modification Det... DET0283 Behavior-chain detection for T1134 Acces... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GhostRedirector

Type: Unknown Active

tracked as Googlebot Storm-0978 Tropical Scorpius Crouching Yeti +26 more

Infrastructure 20 IOC(s)

50%

Domain

Webshell.UY 868id.com 5.97.0.mas.8d580ada.awus log.txt Common.Global.pdb +15

Artifacts (19)

cmd.exe link.exe miniscreen.dll EfsNetAutoUser.exe sqlserver.exe ManagedEngine64.dll +13

Capability

50%

34 technique(s) 51 tool(s)/malware 12 CVE(s)

.NET Reactor Backdoors BadPotato BadPotato exploit Charon ClickFix Cobalt Custom tools +43

T1064 T1085 T1086

command and control

T1008 T1071.001 T1105 T1219

defense impairment

T1112

discovery

T1012 T1083

Victim

70%

Targeted Sectors

telecommunications financial-services manufacturing defense transportation healthcare education retail government aerospace critical-infrastructure aviation energy oil-gas food-agriculture construction media mining entertainment non-profit gaming legal-services utilities hospitality

Targeted Countries

US CN BR VN RU SG CA BY IN NL KZ TW TR JP GB AU EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001 T1583.004 T1587.001 T1588.002 T1588.003

Capability (Malware)

.NET Reactor Backdoors BadPotato

Infrastructure

Webshell.UY 868id.com 5.97.0.mas.8d580ada.awus

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

.NET Reactor Backdoors BadPotato

Infrastructure

Webshell.UY 868id.com 5.97.0.mas.8d580ada.awus

4 Exploitation

Capability (Techniques)

T1053.006 T1059.001 T1059.003 T1106 T1203

Capability (Malware)

.NET Reactor Backdoors BadPotato

Infrastructure

Webshell.UY 868id.com 5.97.0.mas.8d580ada.awus

5 Installation

Capability (Techniques)

T1012 T1083

Capability (Malware)

.NET Reactor Backdoors BadPotato

Infrastructure

Webshell.UY 868id.com 5.97.0.mas.8d580ada.awus

6 Command & Control

Capability (Techniques)

T1008 T1071.001 T1105 T1219 T1534

Capability (Malware)

.NET Reactor Backdoors BadPotato

Infrastructure

Webshell.UY 868id.com 5.97.0.mas.8d580ada.awus

7 Actions on Objectives

Capability (Techniques)

T1565

Capability (Malware)

.NET Reactor Backdoors BadPotato

Infrastructure

Webshell.UY 868id.com 5.97.0.mas.8d580ada.awus