Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC6201 (threat actor)

Risk

Critical

45 techniques 45 tools/malware 16 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.003

Virtual Private Server resource development

T1583.007

Serverless resource development

T1584.008

Network Devices resource development

T1587.001

Malware resource development

T1588.001

Malware resource development

T1608.003

Install Digital Certificate resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2022-38028

CVE CVE-2023-48022

CVE CVE-2024-21887

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-26399

CVE CVE-2025-40551

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-59719

CVE CVE-2026-1281

CVE CVE-2026-1340

CVE CVE-2026-21509

CVE CVE-2026-22769

›

5 Installation

T1003.001

LSASS Memory credential access

T1057

Process Discovery discovery

T1083

File and Directory Discovery discovery

T1098.001

Additional Cloud Credentials persistence

T1136

Create Account persistence

T1505.003

Web Shell persistence

T1543

Create or Modify System Process persistence

›

6 Command & Control

T1005

Data from Local System collection

T1213

Data from Information Repositories collection

T1213.002

Sharepoint collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1071.004

DNS command and control

T1090

Proxy command and control

T1102

Web Service command and control

T1105

Ingress Tool Transfer command and control

T1132

Data Encoding command and control

T1568

Dynamic Resolution command and control

T1572

Protocol Tunneling command and control

T1573

Encrypted Channel command and control

T1550.001

Application Access Token lateral movement

›

7 Actions on Objectives

T1690

Prevent Command History Logging defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1489

Service Stop impact

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1070

Indicator Removal stealth

T1070.004

File Deletion stealth

T1070.006

Timestomp stealth

T1078

Valid Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1564.006

Run Virtual Instance stealth

T1574

Hijack Execution Flow stealth

T1678

Delay Execution stealth

T1067

T1121

Stage risk: Critical High Medium None

Tools & Malware (45)

Astaroth AvosLocker BRICKSTORM BRICKSTORM backdoor Backdoors Beacon C2 infrastructure Cloudflare Workers Cobalt Cobalt Strike Conti Custom malware FrostyGoop FunnyDream GRIMBOLT Garble GitHub Global GuestConduit Heroku Interception J-magic Junction Leverage LockBit Nexus OilRig Open source tools Open-source tools Payload Pikabot PlugX PowerShell Qilin SLAYSTYLE STOP Solar SolarWinds Triton Unknown Warp Web Shell Web Shells YARA phishing

Indicators of Compromise (40)

Domain

VirtualMachine.destroy vim.event.TaskEvent VirtualMachine.clone vim.event.VmBeingClonedEvent vim.event.VmClonedEvent Base64.getDecoder tomcat-users.xml org.apache.catalina.startup.HostConfig.deployWAR +23 more

SHA-256 Hash

90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035 aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878 320a0b5d4900697e125cebb5ff03dee7368f8f087db1c1570b0b62f5a986d759 24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c 45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830 92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df

IPv4 Address

149.248.11.71

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

40 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (13)

M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention +8 more

Installation (16)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity M1026 Privileged Account Management +11 more

Command & Control (14)

M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content +9 more

Actions on Objectives (27)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +22 more

Detection Coverage

43 strategies

6/7 stages covered

Weaponization (6)

DET0829 Detection of Serverless DET0838 Detection of Virtual Private Server DET0840 Detection of Install Digital Certificate DET0845 Detection of Malware DET0859 Detection of Network Devices +1 more

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0514 Detection Strategy for Exploitation for... DET0516 Behavioral Detection of Command and Scri...

Installation (7)

DET0034 Detection of Adversarial Process Discove... DET0363 Detection of Credential Dumping from LSA... DET0370 Recursive Enumeration of Files and Direc... DET0394 Web Shell Detection via Server Behavior... DET0531 Detection Strategy for Additional Cloud... +2 more

Command & Control (14)

DET0027 Detection of Web Protocol-Based C2 Over... DET0039 Detection Strategy for Dynamic Resolutio... DET0060 Detect Ingress Tool Transfers via Behavi... DET0108 Detection Strategy for Data Encoding in... DET0185 Behavioral Detection Strategy for Use Al... +9 more

Actions on Objectives (13)

DET0021 Behavioral Detection for Service Stop ac... DET0127 Behavioral Detection of Masquerading Acr... DET0140 Behavioral Detection of Malicious File D... DET0184 Behavioral Detection of Indicator Remova... DET0218 Detection Strategy for Hijack Execution... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC6201

Type: Unknown Active

CVE-2026-22769 GRIMBOLT tracked as STATIC TUNDRA also tracked as Sandwo +7 more

Infrastructure 32 IOC(s)

50%

Domain

VirtualMachine.destroy vim.event.TaskEvent VirtualMachine.clone vim.event.VmBeingClonedEvent vim.event.VmClonedEvent +26

IPv4 Address

149.248.11.71

Artifacts (8)

Capability

50%

45 technique(s) 45 tool(s)/malware 16 CVE(s)

Astaroth AvosLocker BRICKSTORM BRICKSTORM backdoor Backdoors Beacon C2 infrastructure Cloudflare Workers +37

T1067 T1121

collection

T1005 T1213 T1213.002

command and control

T1071 T1071.001 T1071.004 T1090 +6

credential access

T1003.001

Victim

70%

Targeted Sectors

government financial-services energy defense telecommunications healthcare critical-infrastructure manufacturing transportation aviation maritime media education information-technology chemical think-tank aerospace construction legal-services oil-gas hospitality non-profit nuclear

Targeted Countries

CN US UA RU IN JP DE FR AU KR GB PL CA SG VN TW IR KZ IL TR BR MX ES IT RO NL KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.003 T1583.007 T1584.008 T1587.001 T1588.001

Capability (Malware)

Astaroth AvosLocker BRICKSTORM

Infrastructure

VirtualMachine.destroy vim.event.TaskEvent VirtualMachine.clone

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Astaroth AvosLocker BRICKSTORM

Infrastructure

VirtualMachine.destroy vim.event.TaskEvent VirtualMachine.clone

4 Exploitation

Capability (Techniques)

T1059 T1068

Capability (Malware)

Astaroth AvosLocker BRICKSTORM

Infrastructure

VirtualMachine.destroy vim.event.TaskEvent VirtualMachine.clone

5 Installation

Capability (Techniques)

T1003.001 T1057 T1083 T1098.001 T1136

Capability (Malware)

Astaroth AvosLocker BRICKSTORM

Infrastructure

VirtualMachine.destroy vim.event.TaskEvent VirtualMachine.clone

6 Command & Control

Capability (Techniques)

T1005 T1213 T1213.002 T1071 T1071.001

Capability (Malware)

Astaroth AvosLocker BRICKSTORM

Infrastructure

VirtualMachine.destroy vim.event.TaskEvent VirtualMachine.clone

7 Actions on Objectives

Capability (Techniques)

T1041 T1489

Capability (Malware)

Astaroth AvosLocker BRICKSTORM

Infrastructure

VirtualMachine.destroy vim.event.TaskEvent VirtualMachine.clone