Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC6748 (threat actor)

Risk

High

7 techniques 46 tools/malware 7 vulnerabilities 40 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2015-1701

CVE CVE-2025-14174

CVE CVE-2025-31277

CVE CVE-2025-43510

CVE CVE-2025-43520

CVE CVE-2025-43529

CVE CVE-2026-20700

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1070.008

Clear Mailbox Data stealth

T1542.003

Bootkit stealth

Stage risk: Critical High Medium None

Tools & Malware (46)

Anchor Buhtrap Cobalt Coruna DEADEYE Dark DarkHotel DarkSword ELMER Exploit Kit GHOSTBLADE Ghost RAT Global Hafnium Hellsing Hidden Cobra IRONHALO Jackal Lynx Matrix Mimikatz Mirage Mythic Naikon Nexus Nitro Payload Payload PittyTiger Poseidon Predator Samurai Shamoon Shark SnakeSword Spear-phishing TeamSpy Tsunami Turla Unknown VICEROY Void WhatsApp gcman pe_main.js phishing

Indicators of Compromise (40)

Domain

index.html Math.random JSON.parse sessionStorage.getItem frame.html Date.now top.location.href URL.createObjectURL +12 more

Filename

MachMsgHeaderStruct.js PAC.js PortRightInserter.js InjectJS.js Chain.js 4.js 6.js Native.js +12 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Exploitation (5)

M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Actions on Objectives (7)

M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1029 Remote Data Storage M1031 Network Intrusion Prevention M1046 Boot Integrity +2 more

Detection Coverage

7 strategies

3/7 stages covered

Delivery (2)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0514 Detection Strategy for Exploitation for...

Actions on Objectives (3)

DET0150 Detection Strategy for File Creation or... DET0266 Behavioral Detection of Mailbox Data and... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC6748

Type: Unknown Active

tracked as cpyy APT3 Gothic Panda UPS Team +17 more

Infrastructure 20 IOC(s)

50%

Domain

index.html Math.random JSON.parse sessionStorage.getItem frame.html +15

Artifacts (20)

MachMsgHeaderStruct.js PAC.js PortRightInserter.js InjectJS.js Chain.js 4.js +14

Capability

50%

7 technique(s) 46 tool(s)/malware 7 CVE(s)

Anchor Buhtrap Cobalt Coruna DEADEYE Dark DarkHotel DarkSword +38

execution

T1059.003

exfiltration

T1041

initial access

T1189 T1566.001

privilege escalation

T1068

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy aerospace media education manufacturing information-technology maritime healthcare think-tank pharmaceutical chemical mining hospitality legal-services nuclear entertainment utilities

Targeted Countries

US CN GB IN SA JP DE KR UA TR IR RU TW FR CA IL AU KZ PK VN PL AE SG NL BR ES IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001

Capability (Malware)

Anchor Buhtrap Cobalt

Infrastructure

index.html Math.random JSON.parse

4 Exploitation

Capability (Techniques)

T1059.003 T1068

Capability (Malware)

Anchor Buhtrap Cobalt

Infrastructure

index.html Math.random JSON.parse

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Anchor Buhtrap Cobalt

Infrastructure

index.html Math.random JSON.parse