Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ComicForm (threat actor)

Risk

Medium

0 techniques 40 tools/malware 9 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2018-0171

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-8088

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

BLINDINGCAN Backdoors CHINACHOPPER Carbon Charon ClickFix Cobalt Colony Conti Formbook Gentlemen Global Gunra Hafnium Interlock Interlock ransomware Leverage MINIBIKE MiniJunk Mythic Naikon Nimbus Manticore Payload Payload PhantomCore Phishing campaigns Phishing emails PipeMagic PlugX PowerShell Subtle Snail Telegram Trojan UNC1549 Unknown WarLock Warlock ransomware Winrar curl phishing

Indicators of Compromise (40)

Domain

Encouraged.to.Learn cisa.gov Hunt.io telespazio-careers.com safrangroup-careers.com careers.com journal.pone USA.gov +16 more

Email Address

ics-cert@kaspersky.com lc@raylc.org

Filename

Node.js Future-of-the-Dissertation-Compiled-2024.pdf cmd.exe rundll32.exe application.vbe dogovor.vbe msedge.dll Edge.exe +3 more

MD5 Hash

DAD20CD38B28D253E053CAE7938CB81F

IPv4 Address

25.3.2.20 26.2.5.11

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ComicForm

Type: Unknown Active

tracked as the Beyonders Storm-0978 Tropical Scorpius Crouching Yeti +25 more

Infrastructure 26 IOC(s)

50%

Domain

Encouraged.to.Learn cisa.gov Hunt.io telespazio-careers.com safrangroup-careers.com +19

IPv4 Address

25.3.2.20 26.2.5.11

Artifacts (14)

ics-cert@kaspersky.com lc@raylc.org Node.js Future-of-the-Dissertation-Compiled-2024.pdf cmd.exe rundll32.exe +8

Capability

50%

40 tool(s)/malware 9 CVE(s)

BLINDINGCAN Backdoors CHINACHOPPER Carbon Charon ClickFix Cobalt Colony +32

Victim

70%

Targeted Sectors

telecommunications financial-services manufacturing defense government transportation education healthcare retail aerospace critical-infrastructure aviation energy oil-gas food-agriculture construction media mining entertainment legal-services utilities hospitality

Targeted Countries

RU US BY KZ BR IN TW CA SG VN TR CN JP GB AU EG

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges