Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Inteid (threat actor)

Risk

High

13 techniques 45 tools/malware 3 vulnerabilities 24 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566

Phishing initial access

›

4 Exploitation

CVE CVE-2022-23121

CVE CVE-2026-20316

CVE CVE-2026-63077

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1021.001 – Remote Services: SSH

T1021.004 – Remote Services: RDP

T1040 – Network Sniffing

T1055 – Process Injection

T1059.006 – PowerShell

T1071.002 – Web Protocols (HTTP/HTTPS)

T1075 – Pass the Hash

T1083 – File and Directory Discovery

T1105 – Ingress Tool Transfer

T1204 – User Execution

T1496 – Resource Hijacking (DDoS)

T1566.001 – Spearphishing Attachments

Stage risk: Critical High Medium None

Tools & Malware (45)

9002 RAT 9002 RAT Anchor BLACKCOFFEE BLINDINGCAN BlackByte BlackByte Ransomware BlackCat BlackCat (Eminence) CALENDAR Dairy Dark Deputy Derusbi Derusbi Enfal Explosive Ghost RAT Global GoSerpent Guard Hatef Interception InvisiMole IronErn440 LockBit LockBit ransomware Mimikatz Mirage Mirage Kitten PittyTiger Poison Ivy Qilin Remote access tools Royal SUNBURST SUNBURST (Cobalt Strike variant) Sednit Sofacy TEARDROP Telegram Warsaw npm packages phishing route

Indicators of Compromise (24)

Domain

Barb.ArgentinaArmeniaArubaAustriaAzerbaijanBahamasBahrainBajo Ter.BrazilBritish Is.BruneiBulgariaBurkina Is.Central Rep.ChadChileChinaColombiaComorosCongoCook Is.Costa Rep.EcuadorEgyptEl Is.Falkland +14 more

Email Address

k.barysheva@sahasec.org

Filename

People.pdf

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

6 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more

Detection Coverage

1 strategies

1/7 stages covered

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Inteid

Type: Unknown Active

APT28 Fancy Bear tracked as Pawn Storm the Infrastructure Destruction Squad +25 more

Infrastructure 22 IOC(s)

50%

Domain

Barb.ArgentinaArmeniaArubaAustriaAzerbaijanBahamasBahrainBajo Ter.BrazilBritish Is.BruneiBulgariaBurkina Is.Central Rep.ChadChileChinaColombiaComorosCongoCook +17

Artifacts (2)

k.barysheva@sahasec.org People.pdf

Capability

50%

13 technique(s) 45 tool(s)/malware 3 CVE(s)

9002 RAT 9002 RAT Anchor BLACKCOFFEE BLINDINGCAN BlackByte BlackByte Ransomware BlackCat +37

T1021.001 – Remote Services: SSH T1021.004 – Remote Services: RDP T1040 – Network Sniffing T1055 – Process Injection +8

initial access

T1566

Victim

70%

Targeted Sectors

government critical-infrastructure defense maritime financial-services manufacturing transportation media energy healthcare education utilities pharmaceutical telecommunications aerospace nuclear food-agriculture aviation information-technology retail

Targeted Countries

RU UA US AE PL RO DE GB IT ES IR IL SA SY NL FR CA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

9002 RAT 9002 RAT Anchor

Infrastructure

Barb.ArgentinaArmeniaArubaAustriaAzerbaijanBahamasBahrainBajo Ter.BrazilBritish Is.BruneiBulgariaBurkina