Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

BreachLaboratory (threat actor)

Risk

High

5 techniques 46 tools/malware 4 vulnerabilities 40 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2025-20281

CVE CVE-2025-20282

CVE CVE-2025-20337

CVE CVE-2025-6558

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041 - Exfiltration Over Command and Control Channel

T1049 - System Network Connections Discovery

T1078.004 - Valid Accounts: Remote Services via stolen credentials

T1518.002 - Credentials from Non‑Local System Data Sources

T1566.001 - Spear‑phishing via Email

Stage risk: Critical High Medium None

Tools & Malware (46)

Akira Alphv Backdoor malware Backdoors BianLian BlackCat Clop Cobalt Custom backdoor RAT Custom backdoors Custom malware Dark DarkSide Emotet Emotet (mailware distribution) Ghost RAT Global Guard Hermit Hive Hook Jackal Latrodectus downloader Leverage Lotus loader Malwarebytes Mimikatz (credential dumping) Nexus PLAY Phishing campaigns REvil Rootkit Royal Ryuk STOP SentinelOne Singularity Social engineering tactics SolarWinds Spear-phishing Spear-phishing Campaigns Trojan Turla Wicked Zero-day exploits phishing

Indicators of Compromise (40)

Domain

demo-cloud.space TEMP.Hermit TEMP.Zagros Fal.Con Huntresswindow.dataLayer window.dataLayer window.dataLayer.push css-zkupf3.builder +21 more

Filename

chunk-LFPYN7LY-CAUjWit1.js back-to-top-Dz1MMRlT.js root-1Yp0NENj.js builder-routing-DRBQKtQ4.js entry.client-BB3wyzmd.js site-chrome-BeP0OnUV.js BfLvynJZ.js metadata-CWR3hdAO.js +2 more

MD5 Hash

2ddea77933e345319f335529d35b6c1a

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

BreachLaboratory

Type: Unknown Active

other aliases several other aliases Turla network software application +75 more

Infrastructure 29 IOC(s)

50%

Domain

demo-cloud.space TEMP.Hermit TEMP.Zagros Fal.Con Huntresswindow.dataLayer +24

Artifacts (11)

chunk-LFPYN7LY-CAUjWit1.js back-to-top-Dz1MMRlT.js root-1Yp0NENj.js builder-routing-DRBQKtQ4.js entry.client-BB3wyzmd.js site-chrome-BeP0OnUV.js +5

Capability

50%

5 technique(s) 46 tool(s)/malware 4 CVE(s)

Akira Alphv Backdoor malware Backdoors BianLian BlackCat Clop Cobalt +38

T1041 - Exfiltration Over Command and Control Channel T1049 - System Network Connections Discovery T1078.004 - Valid Accounts: Remote Services via stolen credentials T1518.002 - Credentials from Non‑Local System Data Sources +1

Victim

70%

Targeted Sectors

financial-services government defense healthcare telecommunications critical-infrastructure manufacturing media education energy aviation aerospace think-tank non-profit transportation hospitality maritime retail gaming legal-services utilities nuclear

Targeted Countries

RU CN US IN IR GB BR KP TW KR UA DE CA AU TR VN FR PK

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges