Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Femwar02 (threat actor)

Risk

High

4 techniques 52 tools/malware 3 vulnerabilities 15 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566

Phishing initial access

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2026-20316

CVE CVE-2026-58048

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1486

Data Encrypted for Impact impact

Stage risk: Critical High Medium None

Tools & Malware (52)

Agent Tesla Anchor BabLock Buhtrap CloudDuke Cobalt CosmicDuke CozyDuke DEADEYE Dark DarkHotel DarkLoader Ferocious GeminiDuke Gentlemen Ghost RAT Global HammerDuke Hellsing Hidden Cobra Jackal LockBit Lynx Matrix Mimikatz MiniDuke Mirage Mythic Naikon Nexus Nitro OnionDuke PinchDuke PittyTiger Poseidon Predator Rorschach Samurai SeaDuke Shamoon Shark Spear-phishing TeamSpy Telegram Trojan Tsunami Turla Unknown VICEROY Void gcman phishing

Indicators of Compromise (15)

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +6 more

Email Address

lorenzo@techcrunch.com

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

12 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (9)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1048 Application Isolation and Sandboxing +4 more

Actions on Objectives (4)

M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup M1057 Data Loss Prevention

Detection Coverage

4 strategies

2/7 stages covered

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0176 Drive-by Compromise — Behavior-based, Mu...

Actions on Objectives (2)

DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Femwar02

Type: Unknown Active

tracked as Rorschach Aug 5 ArechClient2 UAT-10027 +38 more

Infrastructure 14 IOC(s)

50%

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +9

Artifacts (1)

lorenzo@techcrunch.com

Capability

50%

4 technique(s) 52 tool(s)/malware 3 CVE(s)

Agent Tesla Anchor BabLock Buhtrap CloudDuke Cobalt CosmicDuke CozyDuke +44

exfiltration

T1041

impact

T1486

initial access

T1189 T1566

Victim

70%

Targeted Sectors

government education defense financial-services non-profit media telecommunications energy aerospace healthcare maritime manufacturing information-technology critical-infrastructure think-tank hospitality pharmaceutical chemical mining utilities legal-services nuclear entertainment

Targeted Countries

US CN GB IN JP DE KR IR RU SA TW FR CA IT AE IL TR AU KZ PK ES VN UA PL SG NL BR IQ BY SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566

Capability (Malware)

Agent Tesla Anchor BabLock

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles

7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

Agent Tesla Anchor BabLock

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles