Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC6508 (threat actor)

Risk

High

20 techniques 48 tools/malware 0 vulnerabilities 17 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

No data

›

5 Installation

T1555

Credentials from Password Stores credential access

T1098.007

Additional Local or Domain Groups persistence

T1505.003

Web Shell persistence

T1554

Compromise Host Software Binary persistence

›

6 Command & Control

T1056.003

Web Portal Capture collection

T1114.003

Email Forwarding Rule collection

T1213

Data from Information Repositories collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1090.003

Multi-hop Proxy command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1689

Downgrade Attack defense impairment

T1567

Exfiltration Over Web Service exfiltration

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

T1078

Valid Accounts stealth

T1218.011

Rundll32 stealth

T1081

T1562.001

Stage risk: Critical High Medium None

Tools & Malware (48)

BRICKSTORM Backdoors C2 infrastructure COOKBOX ClickFix CraxsRAT Custom malware Custom tools Dairy Dark Global Google Drive GuLoader Guard HANGMAN.V2 Handala Hive Hydra INFINITERED INFINITERED malware Interception Leverage MESHAGENT Matrix Nexus PLAY Payload Payload Phishing Kits Phishing emails Phishing kits PowerShell PowerShell commands REDCap RedCap Remote Management Software RoundCube Spear-phishing Spear‑phishing Spectr Telegram Trojan UNC1549 VERMIN Web Shell WhatsApp YARA phishing

Indicators of Compromise (17)

Domain

yeartheregister.comJun TEMP.Vermin Realm.Security help.php Upgrade.php ClinicalTrials.govEU researchcybersecuritydive.comJun

Email Address

BebitaBarefoot774@gmail.com

Filename

pdf.js

SHA-256 Hash

51a57bfc9ed3eb6451c1c289607814d59e1698c666fb97ac5f694c398f23d045 58bb25777e0aa86bcd2125101e0bca4e8732b03d91bd8d2f205b446a2a8d5c86 8f0158855a656b629ca76ebca565f18bc25563ded34b65d6771632c20edb68ec ba6b73b0ca0dc7f86b3b397893ac32d729fd53f9df20643288f141f29d020af7 c1ac43d23f89d41eb4ff131678ab562ab2cfed9aa334b13767ef141d303b0e5b db65c1b9f9e4cb4d729f45ad4b6fcf3e277caf9eb4c875425dec93fd883f9136 4efbef69eb3b09bacff892d6a55778d07c418e7f15eba3cf1245e8cdfd8dda0b

IPv4 Address

23.169.65.49

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Installation (6)

M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1042 Disable or Remove Feature or Program M1045 Code Signing +1 more

Command & Control (11)

M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +6 more

Actions on Objectives (16)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +11 more

Detection Coverage

18 strategies

4/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (4)

DET0310 Suspicious Addition to Local or Domain G... DET0336 Detect Compromise of Host Software Binar... DET0394 Web Shell Detection via Server Behavior... DET0430 Detect Credentials Access from Password...

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0359 Multi-hop Proxy Behavior via Relay Node... DET0413 Abuse of Information Repositories for Da... DET0444 Detection of Command and Control Over Ap... +2 more

Actions on Objectives (6)

DET0350 Detecting Downgrade Attacks DET0378 Behavioral Detection of Obfuscated Files... DET0475 Detection Strategy for T1218.011 Rundll3... DET0508 Behavioral Detection of Process Injectio... DET0548 Detection Strategy for Exfiltration Over... +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC6508

Type: Unknown Active

tracked as coordinat INFINITERED premier academic JokerDPR

Infrastructure 8 IOC(s)

50%

Domain

yeartheregister.comJun TEMP.Vermin Realm.Security help.php Upgrade.php +2

IPv4 Address

23.169.65.49

Artifacts (9)

BebitaBarefoot774@gmail.com pdf.js 51a57bfc9ed3eb6451c1c289607814d59e1698c666fb97ac5f694c398f23d045 58bb25777e0aa86bcd2125101e0bca4e8732b03d91bd8d2f205b446a2a8d5c86 8f0158855a656b629ca76ebca565f18bc25563ded34b65d6771632c20edb68ec ba6b73b0ca0dc7f86b3b397893ac32d729fd53f9df20643288f141f29d020af7 +3

Capability

50%

20 technique(s) 48 tool(s)/malware

BRICKSTORM Backdoors C2 infrastructure COOKBOX ClickFix CraxsRAT Custom malware Custom tools +40

T1081 T1562.001

collection

T1056.003 T1114.003 T1213

command and control

T1071 T1071.001 T1090.003 T1105

credential access

T1555

Victim

70%

Targeted Sectors

healthcare education defense government aerospace manufacturing financial-services energy telecommunications nuclear chemical maritime information-technology legal-services media transportation entertainment utilities

Targeted Countries

United States of America Canada CN US UA RU IL IR CA KP FR KR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

BRICKSTORM Backdoors C2 infrastructure

Infrastructure

yeartheregister.comJun TEMP.Vermin Realm.Security

5 Installation

Capability (Techniques)

T1555 T1098.007 T1505.003 T1554

Capability (Malware)

BRICKSTORM Backdoors C2 infrastructure

Infrastructure

yeartheregister.comJun TEMP.Vermin Realm.Security

6 Command & Control

Capability (Techniques)

T1056.003 T1114.003 T1213 T1071 T1071.001

Capability (Malware)

BRICKSTORM Backdoors C2 infrastructure

Infrastructure

yeartheregister.comJun TEMP.Vermin Realm.Security

7 Actions on Objectives

Capability (Techniques)

T1567

Capability (Malware)

BRICKSTORM Backdoors C2 infrastructure

Infrastructure

yeartheregister.comJun TEMP.Vermin Realm.Security