Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ChainedShark (threat actor)

Risk

High

6 techniques 75 tools/malware 2 vulnerabilities 40 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2015-1701

CVE CVE-2025-2783

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (75)

ATI-Agent AdobeARM Agent.btz Agent.dne Backdoors BlackCat Brute Ratel Buhtrap COATHOOK Carbon Clop Cobalt Cobalt Strike Custom malware Dark DarkHotel Dridex Emotet Ferocious Gazer Global HTRAN Hermit Hidden Cobra Hive IcedID (BokBot) Jackal Kazuar Kimsuky Latrodectus downloader Lotus loader family Lynx Matrix MiniDionis Mirage Naikon Nautilus Net Neuron Nexus PLAY Payload Phishing campaigns Poseidon QUICKBALL QuickPulse SOGU STOP SUNBURST Shark Snake Social engineering tactics Spear-phishing Systeminfo TWOCHAINS Tasklist Tavdig TeamSpy Trojan Tsunami Turla Uroburos VICEROY Void Web Shells WhiteBear Wicked Wipbot credential stealers such as WCE gcman gpresult gsecdump phishing pwdump wce

Indicators of Compromise (40)

Domain

Error.aspx cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao +26 more

Filename

mspaint.exe conhost.exe entry.client-BB3wyzmd.js cdb.exe fontdrvhost.exe

MD5 Hash

2ddea77933e345319f335529d35b6c1a

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (9)

M1019 Threat Intelligence Program M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing +4 more

Actions on Objectives (8)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +3 more

Detection Coverage

6 strategies

3/7 stages covered

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0455 Abuse of PowerShell for Arbitrary Execut... DET0514 Detection Strategy for Exploitation for...

Actions on Objectives (1)

DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ChainedShark

Type: Unknown Active

Actor240820 other aliases several other aliases Jumpy Pisces Gothic Panda +107 more

Infrastructure 34 IOC(s)

50%

Domain

Error.aspx cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad +29

Artifacts (6)

mspaint.exe conhost.exe entry.client-BB3wyzmd.js cdb.exe fontdrvhost.exe 2ddea77933e345319f335529d35b6c1a

Capability

57%

6 technique(s) 75 tool(s)/malware 2 CVE(s)

ATI-Agent AdobeARM Agent.btz Agent.dne Backdoors BlackCat Brute Ratel Buhtrap +67

execution

T1059.001

initial access

T1190 T1566.001 T1566.002

privilege escalation

T1068

stealth

T1078

Victim

70%

Targeted Sectors

government financial-services defense telecommunications healthcare non-profit critical-infrastructure education energy media aerospace manufacturing maritime think-tank information-technology chemical aviation hospitality legal-services pharmaceutical gaming utilities mining transportation retail nuclear entertainment aerospace & defense legal

Targeted Countries

US CN RU IN GB IR KR JP DE SA TW TR FR CA IL BR UA VN AU KZ PK KP PL AE SG NL ES IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001 T1566.002

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

Error.aspx cisa.gov TEMP.Hermit

4 Exploitation

Capability (Techniques)

T1059.001 T1068

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

Error.aspx cisa.gov TEMP.Hermit