Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-2561 (threat actor)

Risk

Medium

0 techniques 48 tools/malware 2 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2025-10035

CVE CVE-2026-26123

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (48)

Akira Akira ransomware BARIUM BadPaw C2 infrastructure CALENDAR Carbon ClickFix Code-signing certificates Custom Backdoor Dark Emissary Gh0st Ghost RAT GitHub Global Group Policy Hunter Imperial Kitten Infostealer Jackal Kazuar Kevin Labyrinth Chollima Legitimate Software MSI installer Malicious ZIP files Microsoft Defender XDR Microsoft Teams Mythic Ninja Payload Payload Qilin Qilin Ransomware STOP ScreenConnect Spark Trojan Tsunami Unknown Void Wicked Winnti curl gh0st RAT npm packages phishing

Indicators of Compromise (40)

Domain

cisa.gov Mallory.ai Hunt.io tidal-campaigns.json MicrosoftMapping.json netml.shop ivanti-pulsesecure.com ivanti-secure-access.org +16 more

Filename

dwmapi.dll PulseSecureService.exe Sophos-Connect-Client.exe GlobalProtect-VPN.exe Pulse.exe inspector.dll VPN-Client.exe vpn.exe +5 more

MD5 Hash

6e258deec1e176516d180d758044c019

IPv4 Address

4.239.95.1 194.76.226.93

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-2561

Type: Unknown Active

tracked as Cisco Storm-2755 CVE-2025-10035

Infrastructure 26 IOC(s)

50%

Domain

cisa.gov Mallory.ai Hunt.io tidal-campaigns.json MicrosoftMapping.json +19

IPv4 Address

4.239.95.1 194.76.226.93

Artifacts (14)

dwmapi.dll PulseSecureService.exe Sophos-Connect-Client.exe GlobalProtect-VPN.exe Pulse.exe inspector.dll +8

Capability

50%

48 tool(s)/malware 2 CVE(s)

Akira Akira ransomware BARIUM BadPaw C2 infrastructure CALENDAR Carbon ClickFix +40

Victim

70%

Targeted Sectors

government defense financial-services hospitality healthcare non-profit think-tank media

Targeted Countries

US IL RU KP IN

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges