Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ZeffSec (threat actor)

Risk

High

5 techniques 53 tools/malware 2 vulnerabilities 18 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566

Phishing initial access

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2025-29824

›

5 Installation

No data

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1498.001

Direct Network Flood impact

T1192

Stage risk: Critical High Medium None

Tools & Malware (53)

Agent Tesla Akira Alphv Buhtrap CloudDuke Cobalt CosmicDuke CozyDuke DEADEYE Dark DarkHotel GeminiDuke Ghost RAT Global Hafnium HammerDuke Hammertoss Hellsing Hidden Cobra Jackal Legitimate Software LockBit Lynx Matrix MiniDionis MiniDuke Mirage Naikon Nexus Nitro OilRig OnionDuke Phishing campaigns PinchDuke Poseidon Predator RansomHub Samurai SeaDuke Sednit Shamoon Shark Spear-phishing TeamSpy Telegram Tsunami Turla VICEROY Void ZooPark gcman malware distribution phishing

Indicators of Compromise (18)

Domain

cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +10 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

7 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (1)

M1037 Filter Network Traffic

Detection Coverage

4 strategies

3/7 stages covered

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0343 Direct Network Flood Detection across Ia...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ZeffSec

Type: Unknown Active

Zeff Security APT28 Pawn Storm Fancy Bear tracked as +30 more

Infrastructure 18 IOC(s)

50%

Domain

cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +13

Capability

50%

5 technique(s) 53 tool(s)/malware 2 CVE(s)

Agent Tesla Akira Alphv Buhtrap CloudDuke Cobalt CosmicDuke CozyDuke +45

T1192

command and control

T1071.001 T1105

impact

T1498.001

initial access

T1566

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications media energy education healthcare aerospace critical-infrastructure manufacturing information-technology think-tank maritime aviation hospitality pharmaceutical chemical mining entertainment transportation retail legal-services nuclear

Targeted Countries

US CN IR GB IN JP DE KR RU SA TW CA FR IL VN TR UA AU KZ PK PL KP AE SG NL BR ES IQ BY IT SY MX RO NG EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

Agent Tesla Akira Alphv

Infrastructure

cisa.gov TEMP.Hermit TEMP.Veles

6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

Agent Tesla Akira Alphv

Infrastructure

cisa.gov TEMP.Hermit TEMP.Veles

7 Actions on Objectives

Capability (Techniques)

T1498.001

Capability (Malware)

Agent Tesla Akira Alphv

Infrastructure

cisa.gov TEMP.Hermit TEMP.Veles