Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

databreachplus (threat actor)

Risk

Medium

2 techniques 46 tools/malware 1 vulnerabilities 37 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2026-50522

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T2008

T2010

Stage risk: Critical High Medium None

Tools & Malware (46)

Apollo Backdoors Bazar BlackCat Chaos Clipper Custom-built malware DNS hijacking Dark Deputy Epic EtherRAT Expand Gentlemen Global Guard Hafnium Infostealer Infostealer malware Kevin Lynx MAUI Malwarebytes PLAY PLEAD Pandora Paradise Phishing campaigns Phishing emails Resident Rhysida Royal STOP ScreenConnect SentinelOne SolarWinds Telegram Titan Trojan Troy Unknown Web Shell Web Shells dearcry jason phishing

Indicators of Compromise (37)

Domain

caribb.ru mekhovaya-shuba.ru beboss34.ru fanonlyatn.xyz REG.RU www.hackersvella.org apps.web.maine.gov BLOCKCHAIN.COM +15 more

Email Address

brant@fairworklaw.com bterrell@terrellmarshall.com hillary@fairworklaw.com tmarshall@terrellmarshall.com james@ferrarolaw.com

SHA-256 Hash

aa11f154b17a4f81f951dbeaab78b58ea012f5b6ea16e4f894bd90971e01bae4 f7ddba605e3d04e06d2f7b0fc4a38027ae58ca65a69d800dd2f43c8e94ca8396 06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092 3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4 584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527 74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150 9d9783f57fd543043e0792d125831883259c823a5eaa69211e5254db4db4eaec

IPv4 Address

103.241.66.238 31.31.198.206

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

databreachplus

Type: Unknown Active

tracked as a checkout fee

Infrastructure 25 IOC(s)

50%

Domain

caribb.ru mekhovaya-shuba.ru beboss34.ru fanonlyatn.xyz REG.RU +18

IPv4 Address

103.241.66.238 31.31.198.206

Artifacts (12)

brant@fairworklaw.com bterrell@terrellmarshall.com hillary@fairworklaw.com tmarshall@terrellmarshall.com james@ferrarolaw.com aa11f154b17a4f81f951dbeaab78b58ea012f5b6ea16e4f894bd90971e01bae4 +6

Capability

50%

2 technique(s) 46 tool(s)/malware 1 CVE(s)

Apollo Backdoors Bazar BlackCat Chaos Clipper Custom-built malware DNS hijacking +38

T2008 T2010

Victim

70%

Targeted Sectors

financial-services healthcare government education hospitality defense media non-profit information-technology mining critical-infrastructure manufacturing gaming construction telecommunications utilities legal-services retail

Targeted Countries

US CA IN PK CN GB SG IL RO KR RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges