Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Mythic Likho (threat actor)

Risk

Critical

8 techniques 61 tools/malware 33 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-0171

CVE CVE-2018-6065

CVE CVE-2021-26084

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-26318

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2024-0132

CVE CVE-2024-3721

CVE CVE-2024-40711

CVE CVE-2024-40766

CVE CVE-2024-53704

CVE CVE-2024-55591

CVE CVE-2025-0108

CVE CVE-2025-1094

CVE CVE-2025-14500

CVE CVE-2025-21391

CVE CVE-2025-21418

CVE CVE-2025-24200

CVE CVE-2025-24472

CVE CVE-2025-29824

CVE CVE-2025-32433

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-6218

CVE CVE-2025-8088

CVE CVE-2026-21385

›

5 Installation

T1555.003

Credentials from Web Browsers credential access

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1055

Process Injection stealth

T1078

Valid Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (61)

.NET executables Ababil Akira AnyDesk BADAUDIO Backdoors CHINACHOPPER (Malware Family) ClickFix Cobalt Cobalt Strike Custom malware GalaxyGato GitHub Global GoRed Gunra Interlock KryBit Loki MINIBIKE Medusa Merlin MiniBrowse stealer MiniJunk backdoor Minibike MuddyWater Mythic Mythic agent Nimbus Manticore Paper Werewolf/GOFFEE Payload Payload PhantomCore PhantomVAI Phishing campaigns Phishing emails PipeMagic PlugX PowerShell Red Likho RustyClaw SNMP tooling SYNful Knock firmware implant Sharp7Extend SnipBot variant SocGholish Spear-phishing Static Tundra Subtle Snail Telegram UNC1549 Unknown VBShower Void WarLock WinRAR Winrar XDSpy curl loki 2.1 implant phishing

Indicators of Compromise (39)

Domain

iam.ottodigital.id ASP.NET NTDS.dit BI.ZONE unpkg.com SSL.com 4ad74aab.cfd 4ad74aab.xyz +11 more

Email Address

editorial@risky.biz ics-cert@kaspersky.com sales@risky.biz

Filename

rundll32.exe Edge.exe msedge.dll MMpLics.dll eskle.sys 06.2025.zip 2025-5.vbe contract-2025-5.vbe +7 more

IPv4 Address

25.3.2.20 26.2.5.11

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Exploitation (5)

M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Installation (5)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1051 Update Software

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (9)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +4 more

Detection Coverage

8 strategies

5/7 stages covered

Delivery (2)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0514 Detection Strategy for Exploitation for...

Installation (1)

DET0037 Detect Suspicious Access to Browser Cred...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (3)

DET0275 Detect Adversary Deobfuscation or Decodi... DET0508 Behavioral Detection of Process Injectio... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Mythic Likho

Type: Unknown Active

Arcane Werewolf Storm-0978 Tropical Scorpius Smoke Sandstorm TA455 +71 more

Infrastructure 21 IOC(s)

50%

Domain

iam.ottodigital.id ASP.NET NTDS.dit BI.ZONE unpkg.com +14

IPv4 Address

25.3.2.20 26.2.5.11

Artifacts (18)

editorial@risky.biz ics-cert@kaspersky.com sales@risky.biz rundll32.exe Edge.exe msedge.dll +12

Capability

50%

8 technique(s) 61 tool(s)/malware 33 CVE(s)

.NET executables Ababil Akira AnyDesk BADAUDIO Backdoors CHINACHOPPER (Malware Family) ClickFix +53

command and control

T1105

credential access

T1555.003

initial access

T1189 T1566.001

privilege escalation

T1068

Victim

70%

Targeted Sectors

financial-services manufacturing defense government telecommunications transportation critical-infrastructure energy healthcare education aerospace retail media food-agriculture aviation construction oil-gas pharmaceutical entertainment utilities chemical maritime mining information-technology legal-services hospitality gaming nuclear

Targeted Countries

US RU IR CN BY UA IL CA GB BR TW KZ EG DE SG VN TR PK IT FR IN MX JP AU KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001

Capability (Malware)

.NET executables Ababil Akira

Infrastructure

iam.ottodigital.id ASP.NET NTDS.dit

4 Exploitation

Capability (Techniques)

T1068

Capability (Malware)

.NET executables Ababil Akira

Infrastructure

iam.ottodigital.id ASP.NET NTDS.dit

5 Installation

Capability (Techniques)

T1555.003

Capability (Malware)

.NET executables Ababil Akira

Infrastructure

iam.ottodigital.id ASP.NET NTDS.dit

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

.NET executables Ababil Akira

Infrastructure

iam.ottodigital.id ASP.NET NTDS.dit