Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GTFire (threat actor)

Risk

High

2 techniques 42 tools/malware 4 vulnerabilities 12 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566

Phishing initial access

›

4 Exploitation

CVE CVE-2025-40552

CVE CVE-2025-40553

CVE CVE-2026-20127

CVE CVE-2026-2256

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1076

Stage risk: Critical High Medium None

Tools & Malware (42)

9002 RAT All-in-1 PHP phishing scripts BLACKCOFFEE C2 infrastructure Cannon Cobalt Conti Conti Ransomware Dark Deputy Derusbi Derusbi Device code phishing Enfal Firefox Gentlemen Ghost RAT GitHub Global Google Firebase hosting Guard Infostealer Leverage Mimikatz More_eggs OilRig Phishing campaigns PittyTiger Poison Ivy PolyVice Qilin SUNBURST SentinelOne SolarWinds SystemBC TEARDROP TeamViewer Telegram WhatsApp curl fast16 phishing

Indicators of Compromise (12)

Domain

domains.web.appdomains cisa.gov min.Read demo-cloud.space web.app translate.goog All-in-1.php GreatFire.org +3 more

Filename

fast16.sys

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

6 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more

Detection Coverage

1 strategies

1/7 stages covered

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GTFire

Type: Unknown Active

tracked as Aug 5 2023 Coroxy CVE-2025-40552 +5 more

Infrastructure 11 IOC(s)

50%

Domain

domains.web.appdomains cisa.gov min.Read demo-cloud.space web.app +6

Artifacts (1)

fast16.sys

Capability

50%

2 technique(s) 42 tool(s)/malware 4 CVE(s)

9002 RAT All-in-1 PHP phishing scripts BLACKCOFFEE C2 infrastructure Cannon Cobalt Conti Conti Ransomware +34

T1076

initial access

T1566

Victim

70%

Targeted Sectors

government financial-services manufacturing mining information-technology defense education

Targeted Countries

IN SG US MX ES TW AU VN JP TR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

9002 RAT All-in-1 PHP phishing scripts BLACKCOFFEE

Infrastructure

domains.web.appdomains cisa.gov min.Read