Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC6671 (threat actor)

Risk

High

6 techniques 44 tools/malware 10 vulnerabilities 38 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

T1566.004

Spearphishing Voice initial access

›

4 Exploitation

CVE CVE-2021-35587

CVE CVE-2022-38028

CVE CVE-2023-48022

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-61882

›

5 Installation

T1557

Adversary-in-the-Middle credential access

T1621

Multi-Factor Authentication Request Generation credential access

T1671

Cloud Application Integration persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (44)

AvosLocker BRICKSTORM Backdoors Clop Cobalt Cobalt Strike Conti Custom malware Dark Expand FrostyGoop FunnyDream Global Guard Hydra Interception J-magic Leverage Matrix Nexus OilRig Open source tools PLAY Phishing campaigns Pikabot Pink PlugX PowerShell PowerShell scripts Python scripts SHINYSP1D3R STOP SUNBURST SentinelOne Session (encrypted messaging) Silence Solar SolarWinds Tox (encrypted messaging) Triton TruffleHog Unknown npm packages phishing

Indicators of Compromise (38)

Domain

Pipe.ma keyokta.com passkeydeploy.com system.multifactor.factor.setup user.authentication PublicDomainRegistry.com Report.pbix getsession.org +24 more

Email Address

victim.user@company.com victim.user@organization.com

IPv4 Address

179.43.185.226 31.7.56.52 193.34.212.132 31.7.56.61

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Installation (10)

M1017 User Training M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network +5 more

Actions on Objectives (8)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +3 more

Detection Coverage

6 strategies

3/7 stages covered

Delivery (2)

DET0236 Detection Strategy for Spearphishing Att... DET0245 Detection Strategy for Spearphishing Voi...

Installation (3)

DET0160 Detection Strategy for Multi-Factor Auth... DET0296 Detect Adversary-in-the-Middle via Netwo... DET0539 Detection Strategy for Cloud Application...

Actions on Objectives (1)

DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC6671

Type: Unknown Active

tracked as UNC6040 UNC6240 STATIC TUNDRA also tracked as Sandwo +4 more

Infrastructure 36 IOC(s)

50%

Domain

Pipe.ma keyokta.com passkeydeploy.com system.multifactor.factor.setup user.authentication +27

IPv4 Address

179.43.185.226 31.7.56.52 193.34.212.132 31.7.56.61

Artifacts (2)

victim.user@company.com victim.user@organization.com

Capability

50%

6 technique(s) 44 tool(s)/malware 10 CVE(s)

AvosLocker BRICKSTORM Backdoors Clop Cobalt Cobalt Strike Conti Custom malware +36

credential access

T1557 T1621

initial access

T1566.001 T1566.004

persistence

T1671

stealth

T1078

Victim

70%

Targeted Sectors

financial-services government energy telecommunications defense healthcare education critical-infrastructure manufacturing transportation aviation retail hospitality maritime information-technology media chemical think-tank aerospace construction legal-services oil-gas non-profit nuclear

Targeted Countries

US CN UA GB IN JP AU IR KR PL CA SG VN TW RU DE KZ IL TR FR BR MX ES IT

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001 T1566.004

Capability (Malware)

AvosLocker BRICKSTORM Backdoors

Infrastructure

Pipe.ma keyokta.com passkeydeploy.com

5 Installation

Capability (Techniques)

T1557 T1621 T1671

Capability (Malware)

AvosLocker BRICKSTORM Backdoors

Infrastructure

Pipe.ma keyokta.com passkeydeploy.com