Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UAC-0227 (threat actor)

Risk

Critical

29 techniques 41 tools/malware 16 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

T1583.003

Virtual Private Server resource development

T1583.004

Server resource development

T1586.002

Email Accounts resource development

T1588.002

Tool resource development

T1650

Acquire Access resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566

Phishing initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1059.010

AutoHotKey & AutoIT execution

T1204.002

Malicious File execution

T1204.004

Malicious Copy and Paste execution

T1548

Abuse Elevation Control Mechanism privilege escalation

T1548.002

Bypass User Account Control privilege escalation

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2019-19781

CVE CVE-2020-10189

CVE CVE-2022-42475

CVE CVE-2024-2617

CVE CVE-2024-3400

CVE CVE-2025-4427

CVE CVE-2025-4428

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53690

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2026-21509

CVE CVE-2026-21513

›

5 Installation

T1552.001

Credentials In Files credential access

›

6 Command & Control

T1005

Data from Local System collection

T1113

Screen Capture collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1071.002

File Transfer Protocols command and control

T1071.003

Mail Protocols command and control

T1071.004

DNS command and control

T1071.005

Publish/Subscribe Protocols command and control

T1090.002

External Proxy command and control

T1105

Ingress Tool Transfer command and control

T1571

Non-Standard Port command and control

T1550.002

Pass the Hash lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1036

Masquerading stealth

Stage risk: Critical High Medium None

Tools & Malware (41)

CASTLELOADER CastleRAT ClickFix Cobalt Cobalt Strike Covenant Explorer FatalRat GitHub Global Group Policy Havoc Kimsuky LAMEHUG Leverage LockBit Matanbuchus MuddyWater Node.js OilRig Payload Payload Phishing emails PlugX PowerShell Pulsynk REvil ReGeorg Sliver Sofacy SolarWinds Spear-phishing Telegram Trixauvex Trojan Turla Winnti curl forge-4626-invariants phishing x402-kit

Indicators of Compromise (40)

Domain

run-update.sh englandloglstics.com update.ini testdomain123123.shop justnewdmain.com update-info4468765.com cdlfreightlogistics.com loadstrucking.com +9 more

Email Address

ics-cert@kaspersky.com

Filename

run-update.cmd Fangao.dll Before.dll wke.dll acvb.exe 0user.exe PO520.rar YX.vbs +5 more

IPv4 Address

178.17.57.103 77.83.207.55 185.39.19.181 192.109.138.102 15.197.240.20 74.119.239.234 104.225.129.171 185.39.19.180 +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (9)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1048 Application Isolation and Sandboxing +4 more

Exploitation (15)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +10 more

Installation (4)

M1017 User Training M1022 Restrict File and Directory Permissions M1027 Password Policies M1047 Audit

Command & Control (8)

M1018 User Account Management M1026 Privileged Account Management M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic +3 more

Actions on Objectives (9)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1038 Execution Prevention +4 more

Detection Coverage

29 strategies

6/7 stages covered

Weaponization (6)

DET0838 Detection of Virtual Private Server DET0852 Detection of Tool DET0861 Detection of Email Accounts DET0871 Detection of Server DET0884 Detection of Acquire Access +1 more

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (6)

DET0294 User Execution – Malicious File via down... DET0332 Detection Strategy for AutoHotKey & Auto... DET0340 User Execution – Malicious Copy & Paste... DET0345 Detection Strategy for Abuse Elevation C... DET0388 Detection Strategy for T1548.002 – Bypas... +1 more

Installation (1)

DET0307 Detect Access to Unsecured Credential Fi...

Command & Control (12)

DET0002 Behavioral Detection of Publish/Subscrib... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0135 Detection of Mail Protocol-Based C2 Acti... DET0227 Detection Strategy for Non-Standard Port... +7 more

Actions on Objectives (2)

DET0127 Behavioral Detection of Masquerading Acr... DET0280 Behavior-Based Registry Modification Det...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UAC-0227

Type: Unknown Active

TAG-160 TAG-161 RefBroker Fancy Bear APT28 +71 more

Infrastructure 26 IOC(s)

50%

Domain

run-update.sh englandloglstics.com update.ini testdomain123123.shop justnewdmain.com +12

IPv4 Address

178.17.57.103 77.83.207.55 185.39.19.181 192.109.138.102 15.197.240.20 +4

Artifacts (14)

ics-cert@kaspersky.com run-update.cmd Fangao.dll Before.dll wke.dll acvb.exe +8

Capability

50%

29 technique(s) 41 tool(s)/malware 16 CVE(s)

CASTLELOADER CastleRAT ClickFix Cobalt Cobalt Strike Covenant Explorer FatalRat +33

collection

T1005 T1113

command and control

T1071 T1071.001 T1071.002 T1071.003 +5

credential access

T1552.001

defense impairment

T1112

Victim

70%

Targeted Sectors

government financial-services transportation defense energy manufacturing telecommunications education critical-infrastructure maritime construction healthcare media non-profit aerospace retail utilities aviation chemical nuclear mining hospitality information-technology

Targeted Countries

US RU UA CN AE KP PL PK TW KZ BR IL SA KR TR BY RO GB MX ES IN NL VN JP SG NG IT DE AZ AU IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001 T1583.003 T1583.004 T1586.002 T1588.002

Capability (Malware)

CASTLELOADER CastleRAT ClickFix

Infrastructure

run-update.sh englandloglstics.com update.ini

3 Delivery

Capability (Techniques)

T1189 T1566

Capability (Malware)

CASTLELOADER CastleRAT ClickFix

Infrastructure

run-update.sh englandloglstics.com update.ini

4 Exploitation

Capability (Techniques)

T1059.001 T1059.010 T1204.002 T1204.004 T1548

Capability (Malware)

CASTLELOADER CastleRAT ClickFix

Infrastructure

run-update.sh englandloglstics.com update.ini

5 Installation

Capability (Techniques)

T1552.001

Capability (Malware)

CASTLELOADER CastleRAT ClickFix

Infrastructure

run-update.sh englandloglstics.com update.ini

6 Command & Control

Capability (Techniques)

T1005 T1113 T1071 T1071.001 T1071.002

Capability (Malware)

CASTLELOADER CastleRAT ClickFix

Infrastructure

run-update.sh englandloglstics.com update.ini