Kill Chain & Diamond Model Analysis
Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.
0day syndicate
(threat actor)
5 techniques
50 tools/malware
40 vulnerabilities
41 IOCs
4/7 stages covered
Deepest: Actions on Objectives
›
›
›
›
›
›
7
Actions on Objectives
2
Stage risk:
Critical
High
Medium
None
Indicators of Compromise (41)
ATT&CK Tactic Coverage
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command & Control
Exfiltration
Impact
Recommended Mitigations
11 MITRE ATT&CK mitigations cover detected techniques
Browse all →
Actions on Objectives
(4)
Detection Coverage
5 strategies
3/7 stages covered
Actions on Objectives
(2)
Diamond Model of Intrusion
Adversary · Capability · Infrastructure · Victim
0day syndicate
Type: Criminal Sophistication: Medium Active
tracked as
Jul 6
2026
Bjorka
SkyWave
+23 more
5 technique(s) 50 tool(s)/malware 40 CVE(s)
Targeted Sectors
healthcare
financial-services
manufacturing
government
construction
critical-infrastructure
food-agriculture
defense
transportation
energy
oil-gas
hospitality
education
telecommunications
retail
information-technology
Targeted Countries
US
BR
CN
GB
RU
NL
PK
CA
AU
FR
IL
IR
Diamond Model Meta-Features
Phase
Actions on Objectives
Direction
Adversary → Infrastructure → Victim
Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges
Activity Threads
Kill chain phase → Diamond Model event mapping