Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

tag-182 (threat actor)

Risk

Critical

19 techniques 43 tools/malware 11 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

T1586

Compromise Accounts resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1203

Exploitation for Client Execution execution

T1204.002

Malicious File execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-11882

CVE CVE-2024-3400

CVE CVE-2024-34102

CVE CVE-2024-41713

CVE CVE-2024-55550

CVE CVE-2024-56145

CVE CVE-2025-0282

CVE CVE-2025-22457

CVE CVE-2025-24813

CVE CVE-2025-32433

CVE CVE-2025-4428

›

5 Installation

T1016

System Network Configuration Discovery discovery

T1033

System Owner/User Discovery discovery

T1082

System Information Discovery discovery

T1133

External Remote Services persistence

›

6 Command & Control

T1005

Data from Local System collection

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1021

Remote Services lateral movement

›

7 Actions on Objectives

T1486

Data Encrypted for Impact impact

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (43)

AsyncRAT Backdoors Bazar BeaverTail ClickFix Cobalt Cobalt Strike Dark GlassWorm Global Kimsuky LODEINFO LockBit LummaC2 MarkiRAT Mobile malware MuddyWater Nexus Octopus OilRig PLAY Payload Payload Phoenix PowerLess PowerShell PowerShell backdoor QakBot ROKRAT RedLine RedLine Stealer SolarWinds StrifeWater Telegram Trojan Turla Winnti certutil curl magecart njRAT nuclei phishing

Indicators of Compromise (40)

Domain

0.pdb phoenix.pdb handala-hack.to handala-redwatned.to PowerLessCLR.pdb TEMP.Periscope novaservice.txt ckAnalyser.pdb +15 more

Filename

novaservice.exe cmd.exe Node.js msiexec.exe powershell.exe WindowsProcesses.exe dll.dll Sou.exe +5 more

SHA-256 Hash

1bcd8d7dc7bed5873bbdd2822e84e19773a33d659b16587ca9dc6db204447a86

IPv4 Address

157.20.182.75 91.214.124.143 148.251.71.182

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (9)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1038 Execution Prevention +4 more

Installation (5)

M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program

Command & Control (9)

M1018 User Account Management M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network +4 more

Actions on Objectives (12)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +7 more

Detection Coverage

19 strategies

6/7 stages covered

Weaponization (2)

DET0876 Detection of Compromise Accounts DET0892 Detection of Domains

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (4)

DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0364 Behavioral Detection Strategy for WMI Ex... DET0514 Detection Strategy for Exploitation for...

Installation (4)

DET0093 Behavioral Detection of User Discovery v... DET0195 Behavioral Detection of System Network C... DET0354 Behavior-chain detection for T1133 Exter... DET0525 System Discovery via Native and Remote U...

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0269 Behavioral Detection Strategy for Remote... DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (4)

DET0215 Detection of Multi-Platform File Encrypt... DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

tag-182

Type: Unknown Active

Charming Kitten Advanced Persistent Threat 39 Chafer Cadelspy Remexi +23 more

Infrastructure 26 IOC(s)

50%

Domain

0.pdb phoenix.pdb handala-hack.to handala-redwatned.to PowerLessCLR.pdb +18

IPv4 Address

157.20.182.75 91.214.124.143 148.251.71.182

Artifacts (14)

novaservice.exe cmd.exe Node.js msiexec.exe powershell.exe WindowsProcesses.exe +8

Capability

50%

19 technique(s) 43 tool(s)/malware 11 CVE(s)

AsyncRAT Backdoors Bazar BeaverTail ClickFix Cobalt Cobalt Strike Dark +35

collection

T1005

command and control

T1071.001 T1105

discovery

T1016 T1033 T1082

execution

T1047 T1203 T1204.002

Victim

70%

Targeted Sectors

government financial-services defense telecommunications energy non-profit critical-infrastructure maritime retail education healthcare aerospace aviation transportation media think-tank information-technology hospitality utilities gaming mining manufacturing

Targeted Countries

Iran, Islamic Republic of CN RU IR UA US IL AE IN KP TW AZ JP BY SA MX PL KR PK KZ IT BR GB TR EG ES VN LB AU FR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001 T1586

Capability (Malware)

AsyncRAT Backdoors Bazar

Infrastructure

0.pdb phoenix.pdb handala-hack.to

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

AsyncRAT Backdoors Bazar

Infrastructure

0.pdb phoenix.pdb handala-hack.to

4 Exploitation

Capability (Techniques)

T1047 T1203 T1204.002 T1068

Capability (Malware)

AsyncRAT Backdoors Bazar

Infrastructure

0.pdb phoenix.pdb handala-hack.to

5 Installation

Capability (Techniques)

T1016 T1033 T1082 T1133

Capability (Malware)

AsyncRAT Backdoors Bazar

Infrastructure

0.pdb phoenix.pdb handala-hack.to

6 Command & Control

Capability (Techniques)

T1005 T1071.001 T1105 T1021

Capability (Malware)

AsyncRAT Backdoors Bazar

Infrastructure

0.pdb phoenix.pdb handala-hack.to

7 Actions on Objectives

Capability (Techniques)

T1486

Capability (Malware)

AsyncRAT Backdoors Bazar

Infrastructure

0.pdb phoenix.pdb handala-hack.to