Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNG0002 (threat actor)

Risk

Critical

26 techniques 48 tools/malware 40 vulnerabilities 37 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.005

Visual Basic execution

T1106

Native API execution

T1204

User Execution execution

T1204.002

Malicious File execution

CVE CVE-2023-33538

CVE CVE-2023-6875

CVE CVE-2024-23897

CVE CVE-2025-26385

CVE CVE-2025-46818

CVE CVE-2025-66430

CVE CVE-2026-0257

CVE CVE-2026-0625

CVE CVE-2026-12569

CVE CVE-2026-12957

CVE CVE-2026-15682

CVE CVE-2026-16812

CVE CVE-2026-22769

CVE CVE-2026-25526

CVE CVE-2026-3102

CVE CVE-2026-31431

CVE CVE-2026-34926

CVE CVE-2026-35033

CVE CVE-2026-40369

CVE CVE-2026-41089

CVE CVE-2026-42271

CVE CVE-2026-42897

CVE CVE-2026-44338

CVE CVE-2026-46300

CVE CVE-2026-46817

CVE CVE-2026-4782

CVE CVE-2026-4798

CVE CVE-2026-48172

CVE CVE-2026-48331

CVE CVE-2026-48939

CVE CVE-2026-49176

CVE CVE-2026-50522

CVE CVE-2026-5140

CVE CVE-2026-52830

CVE CVE-2026-5386

CVE CVE-2026-56291

CVE CVE-2026-58644

CVE CVE-2026-8631

CVE CVE-2026-8632

CVE CVE-2026-9082

›

5 Installation

T1012

Query Registry discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1505

Server Software Component persistence

›

6 Command & Control

T1071

Application Layer Protocol command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1218

System Binary Proxy Execution stealth

T1497

Virtualization/Sandbox Evasion stealth

T1497.001

System Checks stealth

T1620

Reflective Code Loading stealth

T1622

Debugger Evasion stealth

Stage risk: Critical High Medium None

Tools & Malware (48)

BURNBOOK BURNBOOK (adversary label), Backdoors CALENDAR Chaos ClickFix Cobalt Cobalt Strike Cursor Custom reflective injection payloads DLL sideloading loader modules Firefox Gemini CLI Gentlemen GitHub GlassWorm GlassWorm (related malware) Global Infostealer Infostealer malware LNK files Leverage MISTPEN Microsoft Teams MuddyWater Node.js PLAY Payload Payload Phishing campaigns Phishing emails PowerShell Remcos Remcos RAT Remcos RAT (linked tool) ScreenConnect Shadow RAT Shadow RAT SolarWinds Spear-phishing Stealc Telegram Trojan Unknown Vidar WhatsApp npm packages phishing

Indicators of Compromise (37)

Domain

Thumbs.ini Android.MagicAd Context.ai Cal.com Checkout.com Newtonsoft.Json ASP.NET ANY.RUN

Filename

libmupdf.dll BdeUISrv.exe setup.bin Node.js PdfPreview.dll PdfFilter.dll binhex.dll Next.js +5 more

MD5 Hash

a1fdb6d4220598e0f394e0a850343fe9 57e8a7ef21e7586d008d4116d70062a6 28a75771ebdb96d9b49c9369918ca581 a8a7e7494b9ded05685d6b91b1b7ffa6 ab5aeb2f25745580b80d7326bcecc620 bba575d4a89f285cf8c0650be09cc12e 7a2b0d8860a7188a936275907785d421 eca8eb8871c7d8f0c6b9c3ce581416ed +4 more

IPv4 Address

87.120.107.117

URL

http://cmasedu.com/wp-content/plugins/kirki/inc/script.php http://dstvdtt.co.za/wp-content/plugins/social-pug/assets/lib.php http://bmtpakistan.com/solution/wp-content/plugins/one-click-demo-import/assets/asset.php

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (14)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more

Installation (7)

M1018 User Account Management M1024 Restrict Registry Permissions M1026 Privileged Account Management M1042 Disable or Remove Feature or Program M1045 Code Signing +2 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (15)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +10 more

Detection Coverage

26 strategies

5/7 stages covered

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (9)

DET0076 Behavioral Detection of Visual Basic Exe... DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0441 Detection of Suspicious Scheduled Task C... +4 more

Installation (4)

DET0034 Detection of Adversarial Process Discove... DET0209 Detection of Registry Query for Environm... DET0525 System Discovery via Native and Remote U... DET0547 Detection Strategy for T1505 - Server So...

Command & Control (1)

DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (9)

DET0046 Detection Strategy for T1497 Virtualizat... DET0081 Detection of Proxy Execution via Trusted... DET0127 Behavioral Detection of Masquerading Acr... DET0168 Virtualization/Sandbox Evasion via Syste... DET0275 Detect Adversary Deobfuscation or Decodi... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNG0002

Type: Unknown Active

Unknown Group 0002 tracked as Hong Kong Pakistan BURNBOOK +2 more

Infrastructure 12 IOC(s)

50%

Domain

Thumbs.ini Android.MagicAd Context.ai Cal.com Checkout.com +3

IPv4 Address

87.120.107.117

URL

Artifacts (25)

libmupdf.dll BdeUISrv.exe setup.bin Node.js PdfPreview.dll PdfFilter.dll +19

Capability

50%

26 technique(s) 48 tool(s)/malware 40 CVE(s)

BURNBOOK BURNBOOK (adversary label), Backdoors CALENDAR Chaos ClickFix Cobalt Cobalt Strike +40

command and control

T1071

discovery

T1012 T1057 T1082

execution

T1053 T1053.005 T1059 T1059.001 +5

exfiltration

T1041

Victim

70%

Targeted Sectors

financial-services government healthcare education defense energy critical-infrastructure hospitality telecommunications aviation gaming media pharmaceutical manufacturing nuclear retail non-profit maritime aerospace legal-services mining utilities construction information-technology

Targeted Countries

CN IR PK GB UA IN SG JP PL IT CA KR RO TW US TR ES KP MX FR RU BR DE NL AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566 T1566.001 T1566.002

Capability (Malware)

BURNBOOK BURNBOOK (adversary label), Backdoors

Infrastructure

Thumbs.ini Android.MagicAd Context.ai

4 Exploitation

Capability (Techniques)

T1053 T1053.005 T1059 T1059.001 T1059.003

Capability (Malware)

BURNBOOK BURNBOOK (adversary label), Backdoors

Infrastructure

Thumbs.ini Android.MagicAd Context.ai

5 Installation

Capability (Techniques)

T1012 T1057 T1082 T1505

Capability (Malware)

BURNBOOK BURNBOOK (adversary label), Backdoors

Infrastructure

Thumbs.ini Android.MagicAd Context.ai

6 Command & Control

Capability (Techniques)

T1071

Capability (Malware)

BURNBOOK BURNBOOK (adversary label), Backdoors

Infrastructure

Thumbs.ini Android.MagicAd Context.ai

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

BURNBOOK BURNBOOK (adversary label), Backdoors

Infrastructure

Thumbs.ini Android.MagicAd Context.ai