Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TAG-140 (threat actor)

Risk

Critical

10 techniques 41 tools/malware 4 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588.002

Tool resource development

›

3 Delivery

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

T1566.003

Spearphishing via Service initial access

T1566.004

Spearphishing Voice initial access

›

4 Exploitation

T1204.002

Malicious File execution

CVE CVE-2019-11580

CVE CVE-2026-16232

CVE CVE-2026-55040

CVE CVE-2026-9820

›

5 Installation

T1057

Process Discovery discovery

›

6 Command & Control

T1074.001

Local Data Staging collection

›

7 Actions on Objectives

T1486

Data Encrypted for Impact impact

Stage risk: Critical High Medium None

Tools & Malware (41)

BITS Bazar Bumblebee C2 infrastructure ClickFix Cobalt Cobalt Strike Compromised WordPress Sites DRAT DRAT V2 Emotet Expand GitHub Global Group Policy Havoc Interception Kimsuky Leverage Malicious files NetSupport RAT Payload Payload Phishing campaigns Phishing emails PowerShell QakBot Rootkit SectopRAT SmartApeSG SparkRAT Spear-phishing Stealc Trojan Unknown Web Shells WildFire YARA mshta phishing systemd

Indicators of Compromise (40)

Domain

gouvn.me bianchilawgroup.com email.gov.in.drdosurvey.info raw.githubusercontent.com index.php pic1.png persistancejs.store urlscan.io +2 more

Filename

sysinte.hta zuidrt.pdf mshta.exe client32.exe

IPv4 Address

194.180.191.189 5.252.178.123 94.158.245.104 94.158.245.115 94.158.245.118 94.158.245.131 94.158.245.137 94.158.245.13 +18 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

11 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (3)

M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Actions on Objectives (2)

M1040 Behavior Prevention on Endpoint M1053 Data Backup

Detection Coverage

10 strategies

6/7 stages covered

Weaponization (1)

DET0852 Detection of Tool

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0115 Detection Strategy for Spearphishing via... DET0236 Detection Strategy for Spearphishing Att... DET0245 Detection Strategy for Spearphishing Voi...

Exploitation (1)

DET0294 User Execution – Malicious File via down...

Installation (1)

DET0034 Detection of Adversarial Process Discove...

Command & Control (1)

DET0261 Detection of Local Data Staging Prior to...

Actions on Objectives (1)

DET0215 Detection of Multi-Platform File Encrypt...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

TAG-140

Type: Unknown Active

APT36 ProjectM MYTHIC LEOPARD tracked as MYTHIC Leopard +11 more

Infrastructure 36 IOC(s)

50%

Domain

gouvn.me bianchilawgroup.com email.gov.in.drdosurvey.info raw.githubusercontent.com index.php +5

IPv4 Address

194.180.191.189 5.252.178.123 94.158.245.104 94.158.245.115 94.158.245.118 +21

Artifacts (4)

sysinte.hta zuidrt.pdf mshta.exe client32.exe

Capability

50%

10 technique(s) 41 tool(s)/malware 4 CVE(s)

BITS Bazar Bumblebee C2 infrastructure ClickFix Cobalt Cobalt Strike Compromised WordPress Sites +33

collection

T1074.001

discovery

T1057

execution

T1204.002

impact

T1486

Victim

70%

Targeted Sectors

government defense critical-infrastructure legal-services financial-services mining healthcare energy education maritime telecommunications non-profit aerospace hospitality oil-gas transportation gaming aviation manufacturing retail think-tank

Targeted Countries

US TW PK SA CN IN BR MX DE JP AE PL IT KR VN NG IL ES UA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.002

Capability (Malware)

BITS Bazar Bumblebee

Infrastructure

gouvn.me bianchilawgroup.com email.gov.in.drdosurvey.info

3 Delivery

Capability (Techniques)

T1566 T1566.001 T1566.002 T1566.003 T1566.004

Capability (Malware)

BITS Bazar Bumblebee

Infrastructure

gouvn.me bianchilawgroup.com email.gov.in.drdosurvey.info

4 Exploitation

Capability (Techniques)

T1204.002

Capability (Malware)

BITS Bazar Bumblebee

Infrastructure

gouvn.me bianchilawgroup.com email.gov.in.drdosurvey.info

5 Installation

Capability (Techniques)

T1057

Capability (Malware)

BITS Bazar Bumblebee

Infrastructure

gouvn.me bianchilawgroup.com email.gov.in.drdosurvey.info

6 Command & Control

Capability (Techniques)

T1074.001

Capability (Malware)

BITS Bazar Bumblebee

Infrastructure

gouvn.me bianchilawgroup.com email.gov.in.drdosurvey.info

7 Actions on Objectives

Capability (Techniques)

T1486

Capability (Malware)

BITS Bazar Bumblebee

Infrastructure

gouvn.me bianchilawgroup.com email.gov.in.drdosurvey.info