Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Conquerors Electronic Army (threat actor)

Risk

High

13 techniques 43 tools/malware 3 vulnerabilities 20 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2026-32746

CVE CVE-2026-50522

›

5 Installation

T1110

Brute Force credential access

T1555

Credentials from Password Stores credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1491

Defacement impact

T1499

Endpoint Denial of Service impact

T1218.005

Mshta stealth

T0882

T1410

T1476

Stage risk: Critical High Medium None

Tools & Malware (43)

Anchor Buhtrap Cobalt Crimson DEADEYE Dark DarkHotel Epic Global Handala Hellsing Hidden Cobra Jackal Leverage Lynx Malicious APK Matrix Mirage MuddyWater Mythic Naikon Nexus Nitro Phishing campaigns Poseidon Predator Rogue Samurai Shamoon Shark Snake Spear-phishing TeamSpy Telegram Tsunami Turla UNC1549 VICEROY Void Wiper Wiper malware gcman phishing

Indicators of Compromise (20)

Domain

handala-redwanted.to TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +10 more

Email Address

ops@rescana.com Info@rescana.com

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Installation (6)

M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies +1 more

Actions on Objectives (9)

M1018 User Account Management M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic M1038 Execution Prevention +4 more

Detection Coverage

10 strategies

3/7 stages covered

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0236 Detection Strategy for Spearphishing Att...

Installation (2)

DET0430 Detect Credentials Access from Password... DET0463 Brute Force Authentication Failures with...

Actions on Objectives (6)

DET0146 Detection of Data Destruction Across Pla... DET0208 Endpoint Resource Saturation and Crash P... DET0215 Detection of Multi-Platform File Encrypt... DET0238 Defacement via File and Web Content Modi... DET0348 Detection Strategy for Exfiltration Over... +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Conquerors Electronic Army

Type: Unknown Active

APT28 Fancy Bear GalaxyGato Nimbus Manticore aerospace +46 more

Infrastructure 18 IOC(s)

50%

Domain

handala-redwanted.to TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +13

Artifacts (2)

ops@rescana.com Info@rescana.com

Capability

50%

13 technique(s) 43 tool(s)/malware 3 CVE(s)

Anchor Buhtrap Cobalt Crimson DEADEYE Dark DarkHotel Epic +35

T0882 T1410 T1476

credential access

T1110 T1555

exfiltration

T1041

impact

T1485 T1486 T1491 T1499

Victim

70%

Targeted Sectors

government defense financial-services telecommunications non-profit energy critical-infrastructure aerospace media maritime healthcare manufacturing education information-technology think-tank pharmaceutical retail chemical mining aviation hospitality legal-services nuclear entertainment

Targeted Countries

US IR IL CN GB IN JP DE KR SA RU TW FR CA PK AU TR KZ AE VN UA PL IQ BY SG NL BR ES IT SY MX RO LB EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566 T1566.001

Capability (Malware)

Anchor Buhtrap Cobalt

Infrastructure

handala-redwanted.to TEMP.Hermit TEMP.Veles

5 Installation

Capability (Techniques)

T1110 T1555

Capability (Malware)

Anchor Buhtrap Cobalt

Infrastructure

handala-redwanted.to TEMP.Hermit TEMP.Veles

7 Actions on Objectives

Capability (Techniques)

T1041 T1485 T1486 T1491 T1499

Capability (Malware)

Anchor Buhtrap Cobalt

Infrastructure

handala-redwanted.to TEMP.Hermit TEMP.Veles