Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GopherWhisper (threat actor)

Risk

100

Critical

36 techniques 51 tools/malware 40 vulnerabilities 38 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

T1595.003

Wordlist Scanning reconnaissance

›

2 Weaponization

T1583.003

Virtual Private Server resource development

T1583.004

Server resource development

T1584.006

Web Services resource development

T1588.006

Vulnerabilities resource development

T1608.002

Upload Tool resource development

›

3 Delivery

T1566

Phishing initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.003

Windows Command Shell execution

CVE CVE-2017-7692

CVE CVE-2023-33538

CVE CVE-2023-6875

CVE CVE-2024-23897

CVE CVE-2025-26385

CVE CVE-2025-46818

CVE CVE-2025-66430

CVE CVE-2026-0257

CVE CVE-2026-0625

CVE CVE-2026-12569

CVE CVE-2026-12957

CVE CVE-2026-15682

CVE CVE-2026-16812

CVE CVE-2026-22769

CVE CVE-2026-25526

CVE CVE-2026-3102

CVE CVE-2026-31431

CVE CVE-2026-34926

CVE CVE-2026-35033

CVE CVE-2026-40369

CVE CVE-2026-41089

CVE CVE-2026-42271

CVE CVE-2026-42897

CVE CVE-2026-46817

CVE CVE-2026-4782

CVE CVE-2026-4798

CVE CVE-2026-48172

CVE CVE-2026-48331

CVE CVE-2026-48939

CVE CVE-2026-49176

CVE CVE-2026-50522

CVE CVE-2026-5140

CVE CVE-2026-52830

CVE CVE-2026-5386

CVE CVE-2026-56291

CVE CVE-2026-58048

CVE CVE-2026-58644

CVE CVE-2026-8631

CVE CVE-2026-8632

CVE CVE-2026-9082

›

5 Installation

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1005

Data from Local System collection

T1074.001

Local Data Staging collection

T1074.002

Remote Data Staging collection

T1113

Screen Capture collection

T1071.001

Web Protocols command and control

T1090.001

Internal Proxy command and control

T1090.002

External Proxy command and control

T1090.003

Multi-hop Proxy command and control

T1102.002

Bidirectional Communication command and control

T1105

Ingress Tool Transfer command and control

T1132.001

Standard Encoding command and control

T1573.002

Asymmetric Cryptography command and control

T1021.007

Cloud Services lateral movement

T1550.001

Application Access Token lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1048

Exfiltration Over Alternative Protocol exfiltration

T1567.002

Exfiltration to Cloud Storage exfiltration

T1027.013

Encrypted/Encoded File stealth

T1055.001

Dynamic-link Library Injection stealth

T1070.004

File Deletion stealth

T1070.006

Timestomp stealth

T1078.004

Cloud Accounts stealth

T1064

Stage risk: Critical High Medium None

Tools & Malware (51)

AndroRAT Backdoors CALENDAR Chaos ClickFix CompactGopher CrimsonRAT Custom Backdoor Custom backdoors Custom malware EHDevel Firefox GitHub Global Infostealer InvisiMole JabGopher Kimsuky LaxGopher Leverage Microsoft Teams MuddyWater Node.js OilRig PLAY Payload Payload Phishing campaigns Phishing emails PowerShell RatGopher Remcos Remcos RAT RoundCube SSLORDoor ScreenConnect ShadowPad SolarWinds Spear-phishing Stealc Telegram Trojan Turla WhatsApp Whisper.dll Winnti Zebrocy file.io npm packages phishing yty

Indicators of Compromise (38)

Domain

Riskware.Iox ASP.NET file.io amazonaws.com 5.96.1.mas.f98f1e13.awus wamanharipethe.s3.ap-south-1.amazonaws.com HackTool.Proxy Mongolia.GopherWhisper +9 more

Email Address

threatintel@eset.com barrantaya.1010@outlook.com

Filename

powershell.exe Next.js cmd.exe svchost.exe Node.js dsocks.exe svc.exe MessengerClient.exe +3 more

SHA-1 Hash

CB4E50433336707381429707F59C3CBE8D497D98 1DF40A4A31B30B62EC33DC6FECC2C4408302ADC7 7DCFE9EE25841DFD58D3D6871BF867FE32141DFB 77F1970D620216C5FFF4E14A6CCC13FCCC267217 948159A7FC2E688386864BEA59FD40DFFC4B24D6 A3C077BDF8898E612CCD65BC82E7960834ADB2A9

IPv4 Address

255.255.255.0 64.176.85.158

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1042 Disable or Remove Feature or Program M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (5)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention M1047 Audit

Command & Control (11)

M1013 Application Developer Guidance M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention +6 more

Actions on Objectives (16)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +11 more

Detection Coverage

35 strategies

7/7 stages covered

Reconnaissance (2)

DET0867 Detection of Vulnerability Scanning DET0868 Detection of Wordlist Scanning

Weaponization (5)

DET0808 Detection of Vulnerabilities DET0834 Detection of Upload Tool DET0838 Detection of Virtual Private Server DET0871 Detection of Server DET0882 Detection of Web Services

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0441 Detection of Suspicious Scheduled Task C...

Installation (1)

DET0365 Detect Registry and Startup Folder Persi...

Command & Control (14)

DET0008 Behavioral Detection of Remote Cloud Log... DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0060 Detect Ingress Tool Transfers via Behavi... DET0071 Detection of Remote Data Staging Prior t... +9 more

Actions on Objectives (9)

DET0087 Encrypted or Encoded File Payload Detect... DET0131 Behavioral Detection Strategy for Exfilt... DET0140 Behavioral Detection of Malicious File D... DET0280 Behavior-Based Registry Modification Det... DET0348 Detection Strategy for Exfiltration Over... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GopherWhisper

Type: Unknown Active

APT34 Earth Preta Stately Taurus COLDRIVER SEABORGIUM +117 more

Infrastructure 19 IOC(s)

50%

Domain

Riskware.Iox ASP.NET file.io amazonaws.com 5.96.1.mas.f98f1e13.awus +12

IPv4 Address

255.255.255.0 64.176.85.158

Artifacts (19)

threatintel@eset.com barrantaya.1010@outlook.com powershell.exe Next.js cmd.exe svchost.exe +13

Capability

51%

36 technique(s) 51 tool(s)/malware 40 CVE(s)

AndroRAT Backdoors CALENDAR Chaos ClickFix CompactGopher CrimsonRAT Custom Backdoor +43

T1064

collection

T1005 T1074.001 T1074.002 T1113

command and control

T1071.001 T1090.001 T1090.002 T1090.003 +4

defense impairment

T1112

Victim

70%

Targeted Sectors

government financial-services defense telecommunications education healthcare non-profit energy critical-infrastructure think-tank media hospitality aerospace pharmaceutical maritime manufacturing legal-services utilities nuclear aviation gaming entertainment chemical transportation retail mining construction ngo

Targeted Countries

Mongolia CN RU UA US IR IN IL AE PL KR BY PK JP VN GB TR IT TW LB KZ FR IQ DE SA ES CA SG RO NG KP MX BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.002 T1595.003

Capability (Malware)

AndroRAT Backdoors CALENDAR

Infrastructure

Riskware.Iox ASP.NET file.io

2 Weaponization

Capability (Techniques)

T1583.003 T1583.004 T1584.006 T1588.006 T1608.002

Capability (Malware)

AndroRAT Backdoors CALENDAR

Infrastructure

Riskware.Iox ASP.NET file.io

3 Delivery

Capability (Techniques)

T1566 T1566.002

Capability (Malware)

AndroRAT Backdoors CALENDAR

Infrastructure

Riskware.Iox ASP.NET file.io

4 Exploitation

Capability (Techniques)

T1053.005 T1059.003

Capability (Malware)

AndroRAT Backdoors CALENDAR

Infrastructure

Riskware.Iox ASP.NET file.io

5 Installation

Capability (Techniques)

T1547.001

Capability (Malware)

AndroRAT Backdoors CALENDAR

Infrastructure

Riskware.Iox ASP.NET file.io

6 Command & Control

Capability (Techniques)

T1005 T1074.001 T1074.002 T1113 T1071.001

Capability (Malware)

AndroRAT Backdoors CALENDAR

Infrastructure

Riskware.Iox ASP.NET file.io

7 Actions on Objectives

Capability (Techniques)

T1041 T1048 T1567.002

Capability (Malware)

AndroRAT Backdoors CALENDAR

Infrastructure

Riskware.Iox ASP.NET file.io