Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Coinbase Cartel (threat actor)

Risk

Medium

3 techniques 47 tools/malware 2 vulnerabilities 8 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2024-55591

CVE CVE-2025-61882

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1078

Valid Accounts stealth

T1562.006

Stage risk: Critical High Medium None

Tools & Malware (47)

ALPHV ransomware Akira Alphv Anubis Black Basta Conti DEVMAN Dark DragonForce Emissary Firefox Gentlemen GitHub Global Handala Imperial Kitten Infostealer Interlock Jackal Labyrinth Chollima Leverage LockBit Lynx Matrix Medusa Mythic Nexus PLAY Phishing Qilin RansomHouse RansomHub SHINYSP1D3R SafePay Shai-Hulud Shai‑Hulud SideWinder TeamViewer Tsunami Unknown Void Wicked Zero-day exploits curl npm packages phishing rock

Indicators of Compromise (8)

Domain

TEMP.Zagros TEMP.Periscope min.Read outbreak.Find events.Develop protection.Identify

SHA-256 Hash

a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

10 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Actions on Objectives (10)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +5 more

Detection Coverage

2 strategies

1/7 stages covered

Actions on Objectives (2)

DET0348 Detection Strategy for Exfiltration Over... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Coinbase Cartel

Type: Unknown Active

tracked as APT-C-17 Baby Elephant Hardcore Nationalist Leafperforator +4 more

Infrastructure 6 IOC(s)

50%

Domain

TEMP.Zagros TEMP.Periscope min.Read outbreak.Find events.Develop +1

Artifacts (2)

a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917

Capability

50%

3 technique(s) 47 tool(s)/malware 2 CVE(s)

ALPHV ransomware Akira Alphv Anubis Black Basta Conti DEVMAN Dark +39

T1562.006

exfiltration

T1041

stealth

T1078

Victim

70%

Targeted Sectors

healthcare financial-services non-profit manufacturing transportation government media construction think-tank education critical-infrastructure

Targeted Countries

US AE IN BR DE RU IL CA TR IT CN KP KR TW MX AU JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

ALPHV ransomware Akira Alphv

Infrastructure

TEMP.Zagros TEMP.Periscope min.Read