Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

CL-UNK-1068 (threat actor)

Risk

Critical

40 techniques 42 tools/malware 10 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589.001

Credentials reconnaissance

T1590

Gather Victim Network Information reconnaissance

T1590.002

DNS reconnaissance

T1591.001

Determine Physical Locations reconnaissance

T1591.002

Business Relationships reconnaissance

T1592

Gather Victim Host Information reconnaissance

T1592.004

Client Configurations reconnaissance

T1595

Active Scanning reconnaissance

T1595.001

Scanning IP Blocks reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

T1596.001

DNS/Passive DNS reconnaissance

T1596.003

Digital Certificates reconnaissance

T1596.004

CDNs reconnaissance

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.002

DNS Server resource development

T1583.003

Virtual Private Server resource development

T1583.005

Botnet resource development

T1584

Compromise Infrastructure resource development

T1584.002

DNS Server resource development

T1584.005

Botnet resource development

T1586

Compromise Accounts resource development

T1587

Develop Capabilities resource development

T1587.001

Malware resource development

T1587.002

Code Signing Certificates resource development

T1587.003

Digital Certificates resource development

T1588.003

Code Signing Certificates resource development

T1588.004

Digital Certificates resource development

›

3 Delivery

No data

›

4 Exploitation

T1204

User Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

T1548

Abuse Elevation Control Mechanism privilege escalation

CVE CVE-2017-9805

CVE CVE-2021-22205

CVE CVE-2021-4034

CVE CVE-2023-34048

CVE CVE-2024-27198

CVE CVE-2024-51378

CVE CVE-2024-51567

CVE CVE-2024-56145

CVE CVE-2024-9047

CVE CVE-2025-31324

›

5 Installation

T1552

Unsecured Credentials credential access

T1557.002

ARP Cache Poisoning credential access

T1558.004

AS-REP Roasting credential access

T1580

Cloud Infrastructure Discovery discovery

›

6 Command & Control

T1213

Data from Information Repositories collection

T1602

Data from Configuration Repository collection

›

7 Actions on Objectives

T1600.002

Disable Crypto Hardware defense impairment

T1078

Valid Accounts stealth

T1562.008

Stage risk: Critical High Medium None

Tools & Malware (42)

AWS CLI AntSword AppleChris Backdoors Beacon BypassBoss Cobalt Cobalt Strike Custom malware Dark DumpIt GitHub Global Godzilla Leverage Malicious files Mimikatz Nexus PULSEPACK Payload Payload PlugX PowerShell Remote access tools SNOWLIGHT STOP SYNful Knock Sliver Turla VShell Vidar Vidar stealer Volatility Web Shell Web Shells Wevtutil WildFire certutil phishing scanbox systemd wmic

Indicators of Compromise (40)

Domain

cisa.gov Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet Assembly.Load chrome-online.site changelog.json example.timer example.service +4 more

Filename

python20.dll hpp.bat hp.bat a.bat rar.bat rr.bat dmp.bat vo.bat +15 more

IPv4 Address

43.247.135.53 103.30.76.206 154.39.142.177 154.39.137.203 8.212.169.27

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1054 Software Configuration M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Exploitation (16)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +11 more

Installation (14)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more

Command & Control (11)

M1017 User Training M1018 User Account Management M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +6 more

Actions on Objectives (8)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +3 more

Detection Coverage

39 strategies

6/7 stages covered

Reconnaissance (13)

DET0806 Detection of Determine Physical Location... DET0809 Detection of CDNs DET0813 Detection of Credentials DET0817 Detection of Scanning IP Blocks DET0820 Detection of Client Configurations +8 more

Weaponization (15)

DET0833 Detection of Code Signing Certificates DET0837 Detection of Botnet DET0838 Detection of Virtual Private Server DET0844 Detection of Digital Certificates DET0848 Detection of Digital Certificates +10 more

Exploitation (3)

DET0345 Detection Strategy for Abuse Elevation C... DET0478 User Execution – multi-surface behavior... DET0514 Detection Strategy for Exploitation for...

Installation (4)

DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0169 Detection Strategy for Cloud Infrastruct... DET0387 Detect ARP Cache Poisoning Across Linux,... DET0412 Detect Access or Search for Unsecured Cr...

Command & Control (2)

DET0413 Abuse of Information Repositories for Da... DET0592 Detection Strategy for Data from Configu...

Actions on Objectives (2)

DET0494 Detection Strategy for Weaken Encryption... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

CL-UNK-1068

Type: Unknown Active

tracked as STAC6451 was published CL-STA-0048

Infrastructure 17 IOC(s)

50%

Domain

cisa.gov Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet Assembly.Load chrome-online.site +7

IPv4 Address

43.247.135.53 103.30.76.206 154.39.142.177 154.39.137.203 8.212.169.27

Artifacts (23)

python20.dll hpp.bat hp.bat a.bat rar.bat rr.bat +17

Capability

50%

40 technique(s) 42 tool(s)/malware 10 CVE(s)

AWS CLI AntSword AppleChris Backdoors Beacon BypassBoss Cobalt Cobalt Strike +34

T1562.008

collection

T1213 T1602

credential access

T1552 T1557.002 T1558.004

defense impairment

T1600.002

Victim

70%

Targeted Sectors

media government defense pharmaceutical telecommunications critical-infrastructure aviation energy utilities financial-services transportation education retail

Targeted Countries

CN IN BR US PK SG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.001 T1590 T1590.002 T1591.001 T1591.002

Capability (Malware)

AWS CLI AntSword AppleChris

Infrastructure

cisa.gov Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.002 T1583.003 T1583.005

Capability (Malware)

AWS CLI AntSword AppleChris

Infrastructure

cisa.gov Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

4 Exploitation

Capability (Techniques)

T1204 T1068 T1548

Capability (Malware)

AWS CLI AntSword AppleChris

Infrastructure

cisa.gov Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

5 Installation

Capability (Techniques)

T1552 T1557.002 T1558.004 T1580

Capability (Malware)

AWS CLI AntSword AppleChris

Infrastructure

cisa.gov Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

6 Command & Control

Capability (Techniques)

T1213 T1602

Capability (Malware)

AWS CLI AntSword AppleChris

Infrastructure

cisa.gov Mallory.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet