Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Cyber Islamic Resistance (threat actor)

Risk

100

Critical

40 techniques 51 tools/malware 17 vulnerabilities 38 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1590

Gather Victim Network Information reconnaissance

T1595

Active Scanning reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

T1595.003

Wordlist Scanning reconnaissance

T1596.005

Scan Databases reconnaissance

T1598

Phishing for Information reconnaissance

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1585

Establish Accounts resource development

T1587.001

Malware resource development

T1588

Obtain Capabilities resource development

T1588.002

Tool resource development

T1588.005

Exploits resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

T1195

Supply Chain Compromise initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1072

Software Deployment Tools execution

CVE CVE-2017-7921

CVE CVE-2021-33044

CVE CVE-2021-3304412

CVE CVE-2021-36260

CVE CVE-2022-42475

CVE CVE-2023-33538

CVE CVE-2023-6895

CVE CVE-2024-1709

CVE CVE-2024-23113

CVE CVE-2024-55591

CVE CVE-2025-34067

CVE CVE-2025-6218

CVE CVE-2025-8088

CVE CVE-2025-9316

CVE CVE-2026-1281

CVE CVE-2026-1731

CVE CVE-2026-50522

›

5 Installation

T1110.003

Password Spraying credential access

T1136.001

Local Account persistence

›

6 Command & Control

T1005

Data from Local System collection

T1125

Video Capture collection

T1530

Data from Cloud Storage collection

T1071.004

DNS command and control

T1090.002

External Proxy command and control

›

7 Actions on Objectives

T1567

Exfiltration Over Web Service exfiltration

T1485

Data Destruction impact

T1491

Defacement impact

T1491.001

Internal Defacement impact

T1491.002

External Defacement impact

T1561

Disk Wipe impact

T1565

Data Manipulation impact

T1055

Process Injection stealth

T1078

Valid Accounts stealth

T1078.004

Cloud Accounts stealth

T1574.002

Stage risk: Critical High Medium None

Tools & Malware (51)

ALFA TEaM Shell Backdoors C2 Frameworks ClickFix Crisis Custom malware DCHSpy DROPSHOT Dark Dindoor Epic Fakeset GitHub Global Guard Handala HawkEye Imperial Kitten Leverage MINIBIKE MacDownloader MiniJunk MuddyWater Neo-reGeorg Nexus Nimbus Manticore Node.js OilRig Payload Payload Phoenix PowerShell Rclone ReGeorg ReGeorg webshell RustyWater SHAPESHIFT Spear-phishing Specter Stealc TURNEDUP Telegram Telegram channels Tsundere Tsundere Botnet UNC1549 Void WhatsApp Wiper malware malicious HTA files phishing

Indicators of Compromise (38)

Domain

com.red.alertx www.bleepingcomputer.com TEMP.Zagros dreamy-jobs.com israel-talent.com wazayif-halima.org www.zscaler.com Mallory.ai +26 more

Email Address

blog@x90.se

Filename

Node.js explorer.exe RedAlert.apk

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (4)

M1017 User Training M1042 Disable or Remove Feature or Program M1054 Software Configuration M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (18)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +13 more

Exploitation (19)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more

Installation (4)

M1026 Privileged Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies

Command & Control (8)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic +3 more

Actions on Objectives (16)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +11 more

Detection Coverage

39 strategies

7/7 stages covered

Reconnaissance (6)

DET0823 Detection of Phishing for Information DET0830 Detection of Active Scanning DET0858 Detection of Scan Databases DET0867 Detection of Vulnerability Scanning DET0868 Detection of Wordlist Scanning +1 more

Weaponization (6)

DET0827 Detection of Exploits DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool DET0872 Detection of Malware DET0873 Detection of Establish Accounts +1 more

Delivery (6)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... +1 more

Exploitation (4)

DET0094 Cross-Platform Behavioral Detection of S... DET0223 Detection of Adversary Abuse of Software... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri...

Installation (2)

DET0447 T1136.001 Detection Strategy - Local Acc... DET0487 Distributed Password Spraying via Authen...

Command & Control (5)

DET0197 Behavior-chain, platform-aware detection... DET0325 External Proxy Behavior via Outbound Rel... DET0380 Detection of Local Data Collection Prior... DET0400 Behavioral Detection of DNS Tunneling an... DET0484 Multi-Platform Cloud Storage Exfiltratio...

Actions on Objectives (10)

DET0059 Detection Strategy for Data Manipulation DET0082 Internal Website and System Content Defa... DET0137 Detection Strategy for Disk Wipe via Dir... DET0146 Detection of Data Destruction Across Pla... DET0238 Defacement via File and Web Content Modi... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Cyber Islamic Resistance

Type: Unknown Active

tracked as 313 Team Team 313 Charming Kitten Mint Sandstorm +46 more

Infrastructure 34 IOC(s)

50%

Domain

com.red.alertx www.bleepingcomputer.com TEMP.Zagros dreamy-jobs.com israel-talent.com +29

Artifacts (4)

blog@x90.se Node.js explorer.exe RedAlert.apk

Capability

52%

40 technique(s) 51 tool(s)/malware 17 CVE(s)

ALFA TEaM Shell Backdoors C2 Frameworks ClickFix Crisis Custom malware DCHSpy DROPSHOT +43

T1574.002

collection

T1005 T1125 T1530

command and control

T1071.004 T1090.002

credential access

T1110.003

Victim

70%

Targeted Sectors

government defense financial-services telecommunications energy critical-infrastructure healthcare non-profit media manufacturing aerospace maritime transportation utilities aviation pharmaceutical information-technology education oil-gas mining nuclear think-tank

Targeted Countries

IR IL AE US LB IQ TR SA NL RU EG AZ UA SY PK KR IN CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1590 T1595 T1595.002 T1595.003 T1596.005

Capability (Malware)

ALFA TEaM Shell Backdoors C2 Frameworks

Infrastructure

com.red.alertx www.bleepingcomputer.com TEMP.Zagros

2 Weaponization

Capability (Techniques)

T1583 T1585 T1587.001 T1588 T1588.002

Capability (Malware)

ALFA TEaM Shell Backdoors C2 Frameworks

Infrastructure

com.red.alertx www.bleepingcomputer.com TEMP.Zagros

3 Delivery

Capability (Techniques)

T1189 T1190 T1195 T1566 T1566.001

Capability (Malware)

ALFA TEaM Shell Backdoors C2 Frameworks

Infrastructure

com.red.alertx www.bleepingcomputer.com TEMP.Zagros

4 Exploitation

Capability (Techniques)

T1053 T1059 T1059.001 T1072

Capability (Malware)

ALFA TEaM Shell Backdoors C2 Frameworks

Infrastructure

com.red.alertx www.bleepingcomputer.com TEMP.Zagros

5 Installation

Capability (Techniques)

T1110.003 T1136.001

Capability (Malware)

ALFA TEaM Shell Backdoors C2 Frameworks

Infrastructure

com.red.alertx www.bleepingcomputer.com TEMP.Zagros

6 Command & Control

Capability (Techniques)

T1005 T1125 T1530 T1071.004 T1090.002

Capability (Malware)

ALFA TEaM Shell Backdoors C2 Frameworks

Infrastructure

com.red.alertx www.bleepingcomputer.com TEMP.Zagros

7 Actions on Objectives

Capability (Techniques)

T1567 T1485 T1491 T1491.001 T1491.002

Capability (Malware)

ALFA TEaM Shell Backdoors C2 Frameworks

Infrastructure

com.red.alertx www.bleepingcomputer.com TEMP.Zagros