Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

drivesurge (threat actor)

Risk

High

7 techniques 45 tools/malware 1 vulnerabilities 39 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2026-20230

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1027 Hide Artifact (Obfuscated Files)

T1059.003 PowerShell

T1064 Scripting

T1071.001 Web Protocols

T1086 Windows Command Shell

T1140 Deobfuscate/Decode Files or Information

T1189 Drive-by Compromise

Stage risk: Critical High Medium None

Tools & Malware (45)

Backdoor malware Backdoors Bulletproof hosting CHINACHOPPER ClickFix ClickFix Script CountLoader Dark FAKEUPDATES Fake IT support FakeUpdates Installer Firefox GitHub GlassWorm Global Handala Infostealer Infostealer malware Interception Leverage Matrix Mirai Mirai botnet Nexus Nmap Payload Payload Phishing emails PowerShell ROKRAT Remus Rogue STOP ShadowPad Social engineering tactics Spear-phishing Telegram Telegram channels TernDoor Trojan Zero-day exploits ZionSiphon curl malware distribution phishing

Indicators of Compromise (39)

Domain

Namens1.erans.ru cptoptious.com check.first-node.rocks testio.ecartdev.com webgleam.info brightson.icu datumprobe.icu keyview.icu +18 more

Email Address

ali.miri@ryerson.ca

Filename

t.js Update.exe

MD5 Hash

0ca424475803a1cb54908a81a00bd93f

SHA-256 Hash

a84b032b49773c2318b11b1164d1aada69e940229aedbf8185c33fc7dd1d2cdf 29ac78c51bcdfe68c64830bdeb6e41437dd55e2691149741c9b78be03b6c82ea

IPv4 Address

91.92.240.127 46.226.166.57 147.45.42.200

URL

http:///66856ca57ed?force=18ecc7108cd679316bf5900e84f19b256dc399902cdede646493f502ac872cc1a http:///e97b7f7ccab3a?force=1e1ce4e6222396a58d13dddfe64c1dd21f1632bcbe11d1867d44bab4fc646883a http:///ce3cbfc887?force=17aa15de93cf85729ddf970e8d7897f69ece3ca29608f73e784a9ba40c9cea18d http:///ce3cbfc887?force=1

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

drivesurge

Type: Unknown Active

tracked as SHADOW-EARTH-053 Snappybee TernDoor MFA Fatigue +1 more

Infrastructure 33 IOC(s)

50%

Domain

Namens1.erans.ru cptoptious.com check.first-node.rocks testio.ecartdev.com webgleam.info +21

IPv4 Address

91.92.240.127 46.226.166.57 147.45.42.200

URL

Artifacts (6)

ali.miri@ryerson.ca t.js Update.exe 0ca424475803a1cb54908a81a00bd93f a84b032b49773c2318b11b1164d1aada69e940229aedbf8185c33fc7dd1d2cdf 29ac78c51bcdfe68c64830bdeb6e41437dd55e2691149741c9b78be03b6c82ea

Capability

50%

7 technique(s) 45 tool(s)/malware 1 CVE(s)

Backdoor malware Backdoors Bulletproof hosting CHINACHOPPER ClickFix ClickFix Script CountLoader Dark +37

T1027 Hide Artifact (Obfuscated Files) T1059.003 PowerShell T1064 Scripting T1071.001 Web Protocols +3

Victim

70%

Targeted Sectors

financial-services defense government healthcare legal-services manufacturing media energy education information-technology telecommunications critical-infrastructure transportation retail non-profit oil-gas utilities

Targeted Countries

CN IR KP US FR PK IL AE IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges