Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TA2723 (threat actor)

Risk

Medium

0 techniques 41 tools/malware 0 vulnerabilities 40 IOCs 0/7 stages covered

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (41)

9002 RAT BLACKCOFFEE BokBot Brazilian Banking Malware CHINACHOPPER ClickFix Crisis Custom malware Dark Derusbi Derusbi Device code phishing EvilTokens Ghost RAT Global Graphish Hafnium IcedID Interception Leverage Lynx Microsoft Defender XDR Microsoft OneDrive Microsoft Teams Mispadu Nexus Payload Payload Phishing Kit Phishing campaigns Phishing emails PolyVice STOP Satori SocGholish Squarephish Trojan Turla curl macOS ClickFix phishing

Indicators of Compromise (40)

Domain

vercel.app portal-azure.com Railway.com RawEventData.ModifiedProperties RawEventData.ObjectId Mr.Suresh graph-microsoft.com workers.dev +18 more

Email Address

robert.pena@FirstTrustAdvisorsLP.onmicrosoft.com

Filename

Node.js

IPv4 Address

185.81.113.0 196.251.80.184 162.220.232.0 162.220.234.0 89.150.45.0

URL

http://sharefile.progressivesharepoint.top/ http://login.microsoftonline.com/common/oauth2/deviceauth http://microsoft.com/devicelogin http://onlinedocuments- http://blackrockfundmgt.z13.web.core.windows.net http://agimplfundmgt.z13.web.core.windows.net http://progressiveweba.z13.web.core.windows.net

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

TA2723

Type: Unknown Active

tracked as Aug 5 Storm-2372 UNK_AcademicFlare UTA0304 +3 more

Infrastructure 38 IOC(s)

50%

Domain

vercel.app portal-azure.com Railway.com RawEventData.ModifiedProperties RawEventData.ObjectId +21

IPv4 Address

185.81.113.0 196.251.80.184 162.220.232.0 162.220.234.0 89.150.45.0

URL

Artifacts (2)

robert.pena@FirstTrustAdvisorsLP.onmicrosoft.com Node.js

Capability

50%

41 tool(s)/malware

9002 RAT BLACKCOFFEE BokBot Brazilian Banking Malware CHINACHOPPER ClickFix Crisis Custom malware +33

Victim

70%

Targeted Sectors

government financial-services defense manufacturing transportation education think-tank energy hospitality healthcare

Targeted Countries

BR MX IR CN RU UA US

Diamond Model Meta-Features

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges