Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

fox tempest (threat actor)

Risk

High

3 techniques 62 tools/malware 4 vulnerabilities 12 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

›

4 Exploitation

T1059.001

PowerShell execution

CVE CVE-2024-12802

CVE CVE-2026-0300

CVE CVE-2026-41940

CVE CVE-2026-48172

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1036

Masquerading stealth

Stage risk: Critical High Medium None

Tools & Malware (62)

Akira Akira ransomware family AnyDesk BlackByte BlueSky Cobalt Code-signing certificates Dark EV Certs for Sale (SamCodeSign) Emissary Expand Fox Tempest MSaaS Fragtor Gentlemen GitHub Global Guard INC ransomware family Imperial Kitten Interlock Jackal Kazuar Labyrinth Chollima Legitimate Software Leverage Lumma Stealer LummaStealer Malicious files Malwarebytes Medusa Medusa Ransomware Microsoft Defender XDR Microsoft Teams MuddyWater Mythic Oyster Loader Oyster backdoor Oyster malware PLAY Persistence mechanisms PuTTY Qilin Qilin ransomware family Quick Assist Rhysida Rhysida ransomware Rootkit Spark Storm series (Storm-0501/2561/0249) ransomware Telegram Trojan Tsunami Unknown Vanilla Tempest (malware‑signing‑as‑a‑service) Vidar Vidar ransomware Void Webshells Wicked phishing rhysida Ransomware signspace.cloud

Indicators of Compromise (12)

Domain

signspace.cloudDomainAttacker TEMP.Zagros TEMP.Periscope Mallory.ai Realm.Security www.infopackets.com metadata.json privileges.Customers +2 more

Filename

test.js MSTeamsSetup.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (5)

M1017 User Training M1021 Restrict Web-Based Content M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Exploitation (5)

M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing M1049 Antivirus/Antimalware

Actions on Objectives (8)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

3 strategies

3/7 stages covered

Delivery (1)

DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0455 Abuse of PowerShell for Arbitrary Execut...

Actions on Objectives (1)

DET0127 Behavioral Detection of Masquerading Acr...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

fox tempest

Type: Unknown Active

tracked as Vice Spider Vice Society MuddyWater Broomstick +3 more

Infrastructure 10 IOC(s)

50%

Domain

signspace.cloudDomainAttacker TEMP.Zagros TEMP.Periscope Mallory.ai Realm.Security +5

Artifacts (2)

test.js MSTeamsSetup.exe

Capability

50%

3 technique(s) 62 tool(s)/malware 4 CVE(s)

Akira Akira ransomware family AnyDesk BlackByte BlueSky Cobalt Code-signing certificates Dark +54

execution

T1059.001

initial access

T1189

stealth

T1036

Victim

70%

Targeted Sectors

healthcare education government financial-services defense manufacturing critical-infrastructure hospitality information-technology media non-profit construction telecommunications transportation think-tank energy utilities retail

Targeted Countries

United States of America British Indian Ocean Territory China France India US CN IN GB FR CA IL IR RU KP DE ES IT AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189

Capability (Malware)

Akira Akira ransomware family AnyDesk

Infrastructure

signspace.cloudDomainAttacker TEMP.Zagros TEMP.Periscope

4 Exploitation

Capability (Techniques)

T1059.001

Capability (Malware)

Akira Akira ransomware family AnyDesk

Infrastructure

signspace.cloudDomainAttacker TEMP.Zagros TEMP.Periscope