Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Earth Naga (threat actor)

Risk

High

7 techniques 53 tools/malware 4 vulnerabilities 39 IOCs 3/7 stages covered Deepest: Command & Control

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2025-0994

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2025-5777

›

5 Installation

No data

›

6 Command & Control

T1074

Data Staged collection

T1090

Proxy command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (53)

AI-driven autonomous agent Aurora BYOVD rootkit SHADOW‑EARTH‑067 Backdoors Beacon CloudSorcerer v3 Cobalt Cobalt Strike DeedRAT DracuLoader Draculoader Earth Naga backdoor Explorer FINALDRAFT FinalDraft/SquidDoor GitHub GlassWorm Global Hades Impacket Kazuar NetDraft Nexus Payload Payload PowerShell SNAPPYBEE SNAPPYBEE/DeedRAT SNOWLIGHT STOP STOWAWAY SentinelOne Serpent ShadowPad SquidDoor Stowaway ToolShell TrillClient Turla UAT-8302 VSHELL VShell Vidar Vidar stealer ZingDoor certutil curl ipconfig phishing route schtasks whoami wmic

Indicators of Compromise (39)

Domain

result.dat test.ini portscan.txt Win.Loader.CloudSorcerer Win.Tool.dddd Win.Tool.gogo Win.Malware.Stowaway Win.Loader.Agent +9 more

Filename

NETSTAT.EXE ROUTE.EXE nbtscan.exe cmd.exe rar.exe explorer.exe spoolsv.exe net.exe +10 more

IPv4 Address

38.54.32.244 45.135.135.100 85.209.156.3

URL

http://github.com/chainreactors/gogo/releases/download/v2.14.0/gogo_windows_amd64.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (9)

M1019 Threat Intelligence Program M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing +4 more

Command & Control (3)

M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Detection Coverage

7 strategies

3/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0455 Abuse of PowerShell for Arbitrary Execut... DET0514 Detection Strategy for Exploitation for...

Command & Control (3)

DET0014 Detection of Data Staging Prior to Exfil... DET0060 Detect Ingress Tool Transfers via Behavi... DET0445 Detection of Proxy Infrastructure Setup...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Earth Naga

Type: Unknown Active

tracked as the centripetal balancing centrifugal forces the Newscaster Team +6 more

Infrastructure 21 IOC(s)

50%

Domain

result.dat test.ini portscan.txt Win.Loader.CloudSorcerer Win.Tool.dddd +12

IPv4 Address

38.54.32.244 45.135.135.100 85.209.156.3

URL

http://github.com/chainreactors/gogo/releases/download/v2.14.0/gogo_windows_amd64.exe

Artifacts (18)

NETSTAT.EXE ROUTE.EXE nbtscan.exe cmd.exe rar.exe explorer.exe +12

Capability

50%

7 technique(s) 53 tool(s)/malware 4 CVE(s)

AI-driven autonomous agent Aurora BYOVD rootkit SHADOW‑EARTH‑067 Backdoors Beacon CloudSorcerer v3 Cobalt Cobalt Strike +45

collection

T1074

command and control

T1090 T1105

execution

T1059.001

initial access

T1190 T1566.001

Victim

70%

Targeted Sectors

government telecommunications defense retail financial-services critical-infrastructure utilities information-technology education manufacturing media

Targeted Countries

CN IR KP RU US UA JP TW

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

AI-driven autonomous agent Aurora BYOVD rootkit SHADOW‑EARTH‑067

Infrastructure

result.dat test.ini portscan.txt

4 Exploitation

Capability (Techniques)

T1059.001 T1068

Capability (Malware)

AI-driven autonomous agent Aurora BYOVD rootkit SHADOW‑EARTH‑067

Infrastructure

result.dat test.ini portscan.txt

6 Command & Control

Capability (Techniques)

T1074 T1090 T1105

Capability (Malware)

AI-driven autonomous agent Aurora BYOVD rootkit SHADOW‑EARTH‑067

Infrastructure

result.dat test.ini portscan.txt