Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

unc6240 (threat actor)

Risk

Critical

19 techniques 30 tools/malware 1 vulnerabilities 28 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1598

Phishing for Information reconnaissance

›

2 Weaponization

T1585

Establish Accounts resource development

T1586

Compromise Accounts resource development

T1587

Develop Capabilities resource development

T1588

Obtain Capabilities resource development

T1608

Stage Capabilities resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.004

Unix Shell execution

CVE CVE-2026-35273

›

5 Installation

T1083

File and Directory Discovery discovery

T1671

Cloud Application Integration persistence

›

6 Command & Control

T1213

Data from Information Repositories collection

T1090

Proxy command and control

›

7 Actions on Objectives

T1020

Automated Exfiltration exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1036

Masquerading stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1078

Valid Accounts stealth

T1684

Social Engineering stealth

Stage risk: Critical High Medium None

Tools & Malware (30)

8.t exploit document builder ADRecon BRICKSTORM Chaos Clop Dark Device code phishing Global Hive Interlock LaZagne Leverage MESHAGENT Malwarebytes MeshCentral Mimikatz Persistence mechanisms Phishing infrastructure PowerShell Python scripts Raccoon Rover SHINYSP1D3R STOP SentinelOne Social engineering tactics TruffleHog Unknown WarLock phishing

Indicators of Compromise (28)

Domain

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet config.xml Dave.com PSEMHUB.war README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT psappsrv.cfg +2 more

Email Address

shinycorp@tuta.com shinygroup@tuta.com

Filename

meshagent64-v2.exe meshagent64-azure-ops.exe meshagent32-azure-ops.exe enterprise-attack-v18.1-campaigns.xlsx meshctrl.js

SHA-256 Hash

68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309 f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f 2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35 d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f

IPv4 Address

142.11.200.189 176.120.22.24 142.11.200.186 142.11.200.187 142.11.200.188 142.11.200.190

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

31 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (2)

M1017 User Training M1054 Software Configuration

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (2)

M1042 Disable or Remove Feature or Program M1047 Audit

Command & Control (10)

M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +5 more

Actions on Objectives (16)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +11 more

Detection Coverage

19 strategies

7/7 stages covered

Reconnaissance (1)

DET0823 Detection of Phishing for Information

Weaponization (5)

DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0853 Detection of Develop Capabilities DET0873 Detection of Establish Accounts DET0876 Detection of Compromise Accounts

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0384 Behavioral Detection of Unix Shell Execu... DET0516 Behavioral Detection of Command and Scri...

Installation (2)

DET0370 Recursive Enumeration of Files and Direc... DET0539 Detection Strategy for Cloud Application...

Command & Control (2)

DET0413 Abuse of Information Repositories for Da... DET0445 Detection of Proxy Infrastructure Setup...

Actions on Objectives (6)

DET0127 Behavioral Detection of Masquerading Acr... DET0347 Detection Strategy for Masquerading via... DET0397 Automated Exfiltration Detection Strateg... DET0548 Detection Strategy for Exfiltration Over... DET0560 Detection of Valid Account Abuse Across... +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

unc6240

Type: Nation-State Active

tracked as ShinyHunters Kryptonite Panda GINGHAM TYPHOON Leviathan +15 more

Infrastructure 16 IOC(s)

50%

Domain

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet config.xml Dave.com +5

IPv4 Address

142.11.200.189 176.120.22.24 142.11.200.186 142.11.200.187 142.11.200.188 +1

Artifacts (12)

shinycorp@tuta.com shinygroup@tuta.com meshagent64-v2.exe meshagent64-azure-ops.exe meshagent32-azure-ops.exe enterprise-attack-v18.1-campaigns.xlsx +6

Capability

51%

19 technique(s) 30 tool(s)/malware 1 CVE(s)

8.t exploit document builder ADRecon BRICKSTORM Chaos Clop Dark Device code phishing Global +22

collection

T1213

command and control

T1090

discovery

T1083

execution

T1059 T1059.004

Victim

70%

Targeted Sectors

education financial-services government aviation energy healthcare maritime telecommunications defense critical-infrastructure manufacturing retail

Targeted Countries

United States of America IN CN GB US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1598

Capability (Malware)

8.t exploit document builder ADRecon BRICKSTORM

Infrastructure

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

2 Weaponization

Capability (Techniques)

T1585 T1586 T1587 T1588 T1608

Capability (Malware)

8.t exploit document builder ADRecon BRICKSTORM

Infrastructure

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

8.t exploit document builder ADRecon BRICKSTORM

Infrastructure

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

4 Exploitation

Capability (Techniques)

T1059 T1059.004

Capability (Malware)

8.t exploit document builder ADRecon BRICKSTORM

Infrastructure

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

5 Installation

Capability (Techniques)

T1083 T1671

Capability (Malware)

8.t exploit document builder ADRecon BRICKSTORM

Infrastructure

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

6 Command & Control

Capability (Techniques)

T1213 T1090

Capability (Malware)

8.t exploit document builder ADRecon BRICKSTORM

Infrastructure

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet

7 Actions on Objectives

Capability (Techniques)

T1020 T1567

Capability (Malware)

8.t exploit document builder ADRecon BRICKSTORM

Infrastructure

exfil.tar.zst Horizon3.ai vnd.openxmlformats-officedocument.spreadsheetml.sheet