Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UAT-8616 (threat actor)

Risk

High

3 techniques 46 tools/malware 27 vulnerabilities 9 IOCs 3/7 stages covered Deepest: Command & Control

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2021-1675

CVE CVE-2021-22893

CVE CVE-2021-26855

CVE CVE-2021-26857

CVE CVE-2021-34527

CVE CVE-2021-41733

CVE CVE-2022-20775

CVE CVE-2022-22965

CVE CVE-2022-30190

CVE CVE-2022-3602

CVE CVE-2022-3786

CVE CVE-2023-20198

CVE CVE-2023-20273

CVE CVE-2023-23397

CVE CVE-2023-34362

CVE CVE-2023-44487

CVE CVE-2025-0994

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2026-15409

CVE CVE-2026-15410

CVE CVE-2026-16232

CVE CVE-2026-20127

CVE CVE-2026-20182

CVE CVE-2026-20245

›

5 Installation

No data

›

6 Command & Control

T1021.004

SSH lateral movement

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (46)

ARToken AppDomainManager BITS CALENDAR Clop Clop Ransomware Cobalt Cyclops Cyclops Blink DNS hijacking Device code phishing DoubleZero Emotet EvilTokens GitHub Global Group Policy Hafnium HermeticWiper Hook Interception MSBuild Matrix MuddyWater Open-source tools PathWiper Phishing campaigns PowerShell Process Hollowing Rogue STOP SamSam Silence SolarWinds TeamTNT Telegram TetraLoader Truebot Unknown VoidLink Web Shell Windows Command Shell inter netsh phishing systemd

Indicators of Compromise (9)

Domain

DE.AE auth.log Silence.Downloader replay.py

IPv4 Address

20.12.6.1 20.18.2.1 20.15.4.2 20.18.3.1 1.1.1.10

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

13 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (5)

M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Command & Control (3)

M1018 User Account Management M1032 Multi-factor Authentication M1042 Disable or Remove Feature or Program

Detection Coverage

3 strategies

3/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0514 Detection Strategy for Exploitation for...

Command & Control (1)

DET0596 Behavioral Detection of Remote SSH Login...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UAT-8616

Type: Unknown Active

CVE-2026-20127 tracked as UAT-8616 by Cisco Talos Silence.Downloader

Infrastructure 9 IOC(s)

50%

Domain

DE.AE auth.log Silence.Downloader replay.py

IPv4 Address

20.12.6.1 20.18.2.1 20.15.4.2 20.18.3.1 1.1.1.10

Capability

50%

3 technique(s) 46 tool(s)/malware 27 CVE(s)

ARToken AppDomainManager BITS CALENDAR Clop Clop Ransomware Cobalt Cyclops +38

initial access

T1190

lateral movement

T1021.004

privilege escalation

T1068

Victim

70%

Targeted Sectors

critical-infrastructure financial-services healthcare defense energy nuclear government

Targeted Countries

UA CN RU

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

ARToken AppDomainManager BITS

Infrastructure

DE.AE auth.log Silence.Downloader

4 Exploitation

Capability (Techniques)

T1068

Capability (Malware)

ARToken AppDomainManager BITS

Infrastructure

DE.AE auth.log Silence.Downloader

6 Command & Control

Capability (Techniques)

T1021.004

Capability (Malware)

ARToken AppDomainManager BITS

Infrastructure

DE.AE auth.log Silence.Downloader