Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC6619 (threat actor)

Risk

Medium

0 techniques 41 tools/malware 8 vulnerabilities 38 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2019-11580

CVE CVE-2024-2617

CVE CVE-2025-4427

CVE CVE-2025-4428

CVE CVE-2025-53690

CVE CVE-2025-53770

CVE CVE-2026-21509

CVE CVE-2026-21513

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (41)

AnyDesk Babuk Backdoors Behinder Cobalt Cobalt Strike Conti DynoWiper Expand GO Simple Tunnel GOST GitHub Global Godzilla Handala Hydra Hydra Saiga Interception Leverage LockBit Microsoft Teams MuddyWater Neo-reGeorg Payload Payload PhantomCore Phishing campaigns Phishing emails PowerShell ReGeorg Rootkit Spear-phishing Spear-phishing emails Telegram Trojan Unknown VShell Web Shells WildFire eBPF Rootkit phishing

Indicators of Compromise (38)

Domain

dog3rj.tech zamstats.me gouvn.me raw.githubusercontent.com demo-cloud.space BI.ZONE Filen.io Mega.nz +9 more

Filename

NortonSecurity.exe rce.jar muudatused.zip Board.zip DiaoYu.exe Avp.exe SentryEye.exe EPSecurityService.exe +1 more

SHA-256 Hash

7808B1E01EA790548B472026AC783C73A033BB90BBE548BF3006ABFBCB48C52D

IPv4 Address

178.128.109.37 255.255.255.255 138.197.44.208 146.190.152.219 157.230.34.45 157.245.194.54 1.1.1.1 159.65.156.200 +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC6619

Type: Unknown Active

TGR-STA-1030 Shadow Campaigns APT28 tracked as Head Mare +51 more

Infrastructure 28 IOC(s)

50%

Domain

dog3rj.tech zamstats.me gouvn.me raw.githubusercontent.com demo-cloud.space +12

IPv4 Address

178.128.109.37 255.255.255.255 138.197.44.208 146.190.152.219 157.230.34.45 +6

Artifacts (10)

NortonSecurity.exe rce.jar muudatused.zip Board.zip DiaoYu.exe Avp.exe +4

Capability

50%

41 tool(s)/malware 8 CVE(s)

AnyDesk Babuk Backdoors Behinder Cobalt Cobalt Strike Conti DynoWiper +33

Victim

70%

Targeted Sectors

government critical-infrastructure financial-services energy defense manufacturing mining transportation education telecommunications construction aviation maritime healthcare aerospace non-profit retail utilities chemical nuclear media hospitality pharmaceutical

Targeted Countries

RU PL DE TW US BR AE CN IT GB MX KZ UA IL IN SA NG TR RO PK SG KR VN JP BY ES NL

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges