Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-2949 (threat actor)

Risk

High

7 techniques 50 tools/malware 8 vulnerabilities 9 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2022-38028

CVE CVE-2023-48022

CVE CVE-2024-3400

CVE CVE-2024-39717

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1020 (Automated Exfiltration)

T1046 (Network Services Scanning)

T1072 (Software Deployment Tools)

T1078.001 (Valid Accounts: Cloud Accounts)

T1087.001 (Account Discovery)

T1520 (Data Obfuscation)

T1566.001 (Spearphishing Link)

Stage risk: Critical High Medium None

Tools & Malware (50)

AppDomainManager AvosLocker Az CLI AzCopy Azure PowerShell BITS Backdoors BlackEnergy BlueSky Cobalt Cobalt Strike Conti Custom Python Scripts Dark Expand FrostyGoop FunnyDream Global Group Policy Havex RAT Hook Imperial Kitten Interception J-magic Labyrinth Chollima Leverage MSBuild Matrix Microsoft Defender XDR Microsoft Graph API Microsoft Teams Nexus OilRig Pikabot PlugX PowerShell Process Hollowing STOP ScreenConnect SolarWinds Triton Trojan Tsunami Turla Unknown Web Shell inter netsh phishing systemd

Indicators of Compromise (9)

Domain

TEMP.Veles TEMP.Zagros TEMP.Periscope Mallory.ai MicrosoftMapping.json microsoft.storage microsoft.Web microsoft.sql +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-2949

Type: Unknown Active

tracked as ConnectWise Control STATIC TUNDRA also tracked as Sandwo CovertNetwork-1658 +3 more

Infrastructure 9 IOC(s)

50%

Domain

TEMP.Veles TEMP.Zagros TEMP.Periscope Mallory.ai MicrosoftMapping.json +4

Capability

50%

7 technique(s) 50 tool(s)/malware 8 CVE(s)

AppDomainManager AvosLocker Az CLI AzCopy Azure PowerShell BITS Backdoors BlackEnergy +42

T1020 (Automated Exfiltration) T1046 (Network Services Scanning) T1072 (Software Deployment Tools) T1078.001 (Valid Accounts: Cloud Accounts) +3

Victim

70%

Targeted Sectors

government energy financial-services defense healthcare telecommunications aviation education manufacturing critical-infrastructure maritime transportation construction hospitality think-tank non-profit information-technology chemical media aerospace food-agriculture oil-gas nuclear legal-services

Targeted Countries

CN UA US IN JP AU RU IL KR GB PL CA SG VN TW IR DE KZ TR FR BR MX ES IT KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges