Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Camaro Dragon (threat actor)

Risk

High

3 techniques 44 tools/malware 15 vulnerabilities 40 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2017-11882

CVE CVE-2021-20021

CVE CVE-2021-20022

CVE CVE-2021-20023

CVE CVE-2021-22893

CVE CVE-2022-1040

CVE CVE-2022-22948

CVE CVE-2022-27518

CVE CVE-2022-38028

CVE CVE-2022-41328

CVE CVE-2022-42475

CVE CVE-2023-20867

CVE CVE-2023-2868

CVE CVE-2023-34048

CVE CVE-2023-38831

›

5 Installation

No data

›

6 Command & Control

T1071.001

Web Protocols command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1486

Data Encrypted for Impact impact

Stage risk: Critical High Medium None

Tools & Malware (44)

Backdoors Botnets Camaro Dragon Cobalt Cobalt Strike Custom Backdoor Custom malware Expand GitHub Global HoneyMyte Horse Shell Kapeka Kimsuky Korplug LOTUSLITE LaZagne MESHAGENT MOPSLED MQsTTang Mimikatz Moonstone Sleet MuddyWater Nexus Payload Payload PhantomCore PlugX Poison Ivy PowerShell RC4 encryption ShadowPad SideWalk SnakeDisk Spear-phishing TONESHELL Telegram Trojan Visual Studio Code Web Shells WildFire phishing purpleink schtasks

Indicators of Compromise (40)

Domain

req.ServicePoint.CurrentConnections BI.ZONE yutube.com.de advanced-ip-sccanner.com Temp.Hex System.Text.Encoding System.Net.WebRequest data.dat +14 more

Email Address

ics-cert@kaspersky.com

Filename

tmp.zip cmd.exe passwordgenerator.exe RoboForm.dll user32.dll powershell.exe code.exe Listeners.bat +4 more

IPv4 Address

62.233.57.136 103.159.132.91 103.169.90.132 23.106.123.59 5.188.33.190

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

5 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (4)

M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup M1057 Data Loss Prevention

Detection Coverage

3 strategies

2/7 stages covered

Command & Control (1)

DET0027 Detection of Web Protocol-Based C2 Over...

Actions on Objectives (2)

DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Camaro Dragon

Type: Unknown Active

Mustang Panda Earth Preta Stately Taurus BRONZE PRESIDENT Bronze President +46 more

Infrastructure 27 IOC(s)

50%

Domain

req.ServicePoint.CurrentConnections BI.ZONE yutube.com.de advanced-ip-sccanner.com Temp.Hex +17

IPv4 Address

62.233.57.136 103.159.132.91 103.169.90.132 23.106.123.59 5.188.33.190

Artifacts (13)

ics-cert@kaspersky.com tmp.zip cmd.exe passwordgenerator.exe RoboForm.dll user32.dll +7

Capability

50%

3 technique(s) 44 tool(s)/malware 15 CVE(s)

Backdoors Botnets Camaro Dragon Cobalt Cobalt Strike Custom Backdoor Custom malware Expand +36

command and control

T1071.001

exfiltration

T1041

impact

T1486

Victim

70%

Targeted Sectors

government defense financial-services telecommunications education critical-infrastructure manufacturing transportation pharmaceutical aerospace aviation construction energy think-tank non-profit maritime healthcare information-technology utilities mining nuclear

Targeted Countries

CN US TW PK UA RU KR IN VN AU IL TR EG IT BY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

6 Command & Control

Capability (Techniques)

T1071.001

Capability (Malware)

Backdoors Botnets Camaro Dragon

Infrastructure

req.ServicePoint.CurrentConnections BI.ZONE yutube.com.de

7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

Backdoors Botnets Camaro Dragon

Infrastructure

req.ServicePoint.CurrentConnections BI.ZONE yutube.com.de