Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ghost stadium (threat actor)

Risk

High

2 techniques 48 tools/malware 10 vulnerabilities 40 IOCs 3/7 stages covered Deepest: Command & Control

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

CVE CVE-2020-16040

CVE CVE-2021-44228

CVE CVE-2022-0543

CVE CVE-2023-23397

CVE CVE-2023-38831

CVE CVE-2024-420093

CVE CVE-2024-50379

CVE CVE-2025-324332

CVE CVE-2026-48558

CVE CVE-2026-55255

›

5 Installation

No data

›

6 Command & Control

T1071.003

Mail Protocols command and control

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (48)

Backdoors Black Basta Bumblebee ClickFix Cobalt Conti DUCKTAIL Dark Gentlemen Ghost RAT GitHub Global Hades IcedID Infostealer Layui 2.7.6 UI framework Leverage LockBit Lumma Stealer Meduza Stealer MuddyWater Nexus NotPetya PLAY Phishing Kit Phishing campaigns Phishing emails Phishing kits PingIdentity SSO client_id extraction script PowerShell Qilin RansomHub React‑based phishing kit Rogue STOP Shai-Hulud SideWinder SimpleHelp SocGholish Telegram Trojan Unknown ValleyRAT Vidar WannaCry WhatsApp XLoader phishing

Indicators of Compromise (40)

Domain

Fifa.cafe fifa.black fifa.tax fifa.red fifa.fund fifa-tickets.vip fifa-web.co fifa.bio +26 more

Filename

Node.js

SHA-256 Hash

b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17 00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2

IPv4 Address

43.98.183.110

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

8 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Detection Coverage

2 strategies

2/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Command & Control (1)

DET0135 Detection of Mail Protocol-Based C2 Acti...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

ghost stadium

Type: Unknown Active

tracked as YoroTrooper Mustang Panda T-APT-04 RattleSnake +23 more

Infrastructure 35 IOC(s)

50%

Domain

Fifa.cafe fifa.black fifa.tax fifa.red fifa.fund +29

IPv4 Address

43.98.183.110

Artifacts (5)

Node.js b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17 00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2

Capability

50%

2 technique(s) 48 tool(s)/malware 10 CVE(s)

Backdoors Black Basta Bumblebee ClickFix Cobalt Conti DUCKTAIL Dark +40

command and control

T1071.003

initial access

T1566.001

Victim

70%

Targeted Sectors

information-technology entertainment financial-services government defense healthcare media telecommunications aviation manufacturing hospitality maritime retail gaming critical-infrastructure education transportation energy nuclear

Targeted Countries

United States of America Argentina Brazil Canada Colombia Mexico US CN MX IN UA SG EG RU BR AU VN PK CA FR IT RO NL SA JP IL IR GB

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Backdoors Black Basta Bumblebee

Infrastructure

Fifa.cafe fifa.black fifa.tax

6 Command & Control

Capability (Techniques)

T1071.003

Capability (Malware)

Backdoors Black Basta Bumblebee

Infrastructure

Fifa.cafe fifa.black fifa.tax