Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Team46 (threat actor)

Risk

Critical

18 techniques 38 tools/malware 4 vulnerabilities 4 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1203

Exploitation for Client Execution execution

CVE CVE-2024-6473

CVE CVE-2025-14174

CVE CVE-2025-2783

CVE CVE-2026-50522

›

5 Installation

T1555

Credentials from Password Stores credential access

T1082

System Information Discovery discovery

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1005

Data from Local System collection

T1056.001

Keylogging collection

T1113

Screen Capture collection

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1211

Exploitation for Stealth stealth

Stage risk: Critical High Medium None

Tools & Malware (38)

COZYDUKE CloudDuke Cobalt Cobalt Strike CosmicDuke Custom Backdoor Custom Loader Dante Dark Donut Gh0stBins GitHub Global Hermes Hermes AI Agent KONNI Kiro MiniDuke OnionDuke Persistence mechanisms Phishing emails PowerShell PowerShell code PowerShell scripts Rclone Remote access trojans Rogue SeaDuke Spear-phishing Spear-phishing emails Telegram Trinper Backdoor Unknown WhatsApp Zero-day exploits curl phishing sqlmap

Indicators of Compromise (4)

Domain

JQL-use-filter-advanced.jpg

Email Address

ops@rescana.com Info@rescana.com

Filename

cmd.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (12)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +7 more

Installation (3)

M1026 Privileged Account Management M1027 Password Policies M1051 Update Software

Command & Control (3)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1057 Data Loss Prevention

Actions on Objectives (12)

M1017 User Training M1019 Threat Intelligence Program M1024 Restrict Registry Permissions M1026 Privileged Account Management M1031 Network Intrusion Prevention +7 more

Detection Coverage

18 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0287 Exploitation for Client Execution – cros... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri...

Installation (3)

DET0365 Detect Registry and Startup Folder Persi... DET0430 Detect Credentials Access from Password... DET0525 System Discovery via Native and Remote U...

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0346 Detect Screen Capture via Commands and A... DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (6)

DET0275 Detect Adversary Deobfuscation or Decodi... DET0280 Behavior-Based Registry Modification Det... DET0348 Detection Strategy for Exfiltration Over... DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio... +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Team46

Type: Unknown Active

TaxOff tracked as Gh0stBins sometimes the Gh0stCringe RAT the same +5 more

Infrastructure 1 IOC(s)

50%

Domain

JQL-use-filter-advanced.jpg

Artifacts (3)

ops@rescana.com Info@rescana.com cmd.exe

Capability

50%

18 technique(s) 38 tool(s)/malware 4 CVE(s)

COZYDUKE CloudDuke Cobalt Cobalt Strike CosmicDuke Custom Backdoor Custom Loader Dante +30

collection

T1005 T1056.001 T1113

command and control

T1071.001 T1105

credential access

T1555

defense impairment

T1112

Victim

70%

Targeted Sectors

government financial-services media education defense telecommunications energy

Targeted Countries

RU BY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

COZYDUKE CloudDuke Cobalt

Infrastructure

JQL-use-filter-advanced.jpg

4 Exploitation

Capability (Techniques)

T1059 T1059.001 T1203

Capability (Malware)

COZYDUKE CloudDuke Cobalt

Infrastructure

JQL-use-filter-advanced.jpg

5 Installation

Capability (Techniques)

T1555 T1082 T1547.001

Capability (Malware)

COZYDUKE CloudDuke Cobalt

Infrastructure

JQL-use-filter-advanced.jpg

6 Command & Control

Capability (Techniques)

T1005 T1056.001 T1113 T1071.001 T1105

Capability (Malware)

COZYDUKE CloudDuke Cobalt

Infrastructure

JQL-use-filter-advanced.jpg

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

COZYDUKE CloudDuke Cobalt

Infrastructure

JQL-use-filter-advanced.jpg