Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Storm-0252 (threat actor)

Risk

Critical

40 techniques 56 tools/malware 11 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.004

Spearphishing Voice initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1204.002

Malicious File execution

T1569.002

Service Execution execution

CVE CVE-2014-6352

CVE CVE-2018-0101

CVE CVE-2022-42475

CVE CVE-2024-20353

CVE CVE-2024-20359

CVE CVE-2024-3400

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2025-20363

CVE CVE-2025-31324

CVE CVE-2026-20182

›

5 Installation

T1003.001

LSASS Memory credential access

T1003.002

Security Account Manager credential access

T1016

System Network Configuration Discovery discovery

T1033

System Owner/User Discovery discovery

T1046

Network Service Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1135

Network Share Discovery discovery

T1037

Boot or Logon Initialization Scripts persistence

T1133

External Remote Services persistence

T1547.001

Registry Run Keys / Startup Folder persistence

T1653

Power Settings persistence

›

6 Command & Control

T1005

Data from Local System collection

T1105

Ingress Tool Transfer command and control

T1219

Remote Access Tools command and control

T1572

Protocol Tunneling command and control

T1021.001

Remote Desktop Protocol lateral movement

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1553.002

Code Signing defense impairment

T1685

Disable or Modify Tools defense impairment

T1020

Automated Exfiltration exfiltration

T1052.001

Exfiltration over USB exfiltration

T1567.002

Exfiltration to Cloud Storage exfiltration

T1486

Data Encrypted for Impact impact

T1036.005

Match Legitimate Resource Name or Location stealth

T1055

Process Injection stealth

T1140

Deobfuscate/Decode Files or Information stealth

T0874

T1070.001

T1562

T1562.001

T5000

T9000

Stage risk: Critical High Medium None

Tools & Malware (56)

Akira BOLDMOVE Backdoor malware Backdoors BeaverTail BlackByte Brave Prince Cobalt Cobalt Strike Cobalt Strike ConnectWise Conti Conti ransomware Custom Backdoor Dark Exaramel Gentlemen GitHub Gootkit Kimsuky Line Dancer Line Runner LockBit Luna Medusa Medusa Ransomware Medusa ransomware Mimikatz Mobile malware MuddyWater Naikon NoFive (T9000) OilRig PLAY PUBLOAD Pay2Key Payload Payload Pikabot Plat1 PlugX PowerShell PowerShell backdoor PowerShell backdoor scripts Qilin REvil Rclone Rootkit Shamoon SodaMaster SolarWinds TrickBot Trojan Turla Web Shell phishing

Indicators of Compromise (40)

Domain

halcyon.ai itdesk.com cisa.gov Trojan-SMS.AndroidOS.OpFake Trojan.Mebromi privnote.com LOCKBIT.BLACK it.com +19 more

Filename

SuperOps.msi enterprise-attack-v17.1-software.xlsx PACLOUD.exe Windows365.exe net.exe cipher.exe Node.js

MD5 Hash

1515480F4B538B669648B17C02337098

IPv4 Address

192.236.147.138 193.141.60.212 192.236.147.131 192.236.146.173 192.236.154.158

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (1)

M1017 User Training

Exploitation (11)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +6 more

Installation (16)

M1017 User Training M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1025 Privileged Process Integrity +11 more

Command & Control (13)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +8 more

Actions on Objectives (14)

M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +9 more

Detection Coverage

34 strategies

5/7 stages covered

Delivery (1)

DET0245 Detection Strategy for Spearphishing Voi...

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0421 Detection Strategy for System Services S... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (13)

DET0034 Detection of Adversarial Process Discove... DET0085 Credential Dumping from SAM via Registry... DET0093 Behavioral Detection of User Discovery v... DET0112 Boot or Logon Initialization Scripts Det... DET0182 Behavior-chain detection for T1135 Netwo... +8 more

Command & Control (6)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0327 Multi-event Detection Strategy for RDP-B... DET0380 Detection of Local Data Collection Prior... DET0496 Behavior-Chain Detection for Remote Acce... DET0538 Detection Strategy for Protocol Tunnelin... +1 more

Actions on Objectives (9)

DET0215 Detection of Multi-Platform File Encrypt... DET0220 Detection of USB-Based Data Exfiltration DET0230 Detect Suspicious or Malicious Code Sign... DET0275 Detect Adversary Deobfuscation or Decodi... DET0347 Detection Strategy for Masquerading via... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Storm-0252

Type: Unknown Active

CHATTY SPIDER Luna Moth UNC3753 Silent Ransom Group UAT4356 by Talos +13 more

Infrastructure 32 IOC(s)

50%

Domain

halcyon.ai itdesk.com cisa.gov Trojan-SMS.AndroidOS.OpFake Trojan.Mebromi +22

IPv4 Address

192.236.147.138 193.141.60.212 192.236.147.131 192.236.146.173 192.236.154.158

Artifacts (8)

SuperOps.msi enterprise-attack-v17.1-software.xlsx PACLOUD.exe Windows365.exe net.exe cipher.exe +2

Capability

50%

40 technique(s) 56 tool(s)/malware 11 CVE(s)

Akira BOLDMOVE Backdoor malware Backdoors BeaverTail BlackByte Brave Prince Cobalt +48

T0874 T1070.001 T1562 T1562.001 +2

collection

T1005

command and control

T1105 T1219 T1572

credential access

T1003.001 T1003.002

Victim

70%

Targeted Sectors

financial-services government manufacturing defense telecommunications transportation energy legal-services healthcare critical-infrastructure education construction utilities media information-technology retail aerospace chemical mining nuclear pharmaceutical aviation maritime hospitality gaming food-agriculture

Targeted Countries

US CN RU UA BR KR GB IN AU IR PL IL MX DE ES CA JP RO TR SY TW IT SA FR VN SG PK AE NL AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.004

Capability (Malware)

Akira BOLDMOVE Backdoor malware

Infrastructure

halcyon.ai itdesk.com cisa.gov

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001 T1059.003 T1204.002 T1569.002

Capability (Malware)

Akira BOLDMOVE Backdoor malware

Infrastructure

halcyon.ai itdesk.com cisa.gov

5 Installation

Capability (Techniques)

T1003.001 T1003.002 T1016 T1033 T1046

Capability (Malware)

Akira BOLDMOVE Backdoor malware

Infrastructure

halcyon.ai itdesk.com cisa.gov

6 Command & Control

Capability (Techniques)

T1005 T1105 T1219 T1572 T1021.001

Capability (Malware)

Akira BOLDMOVE Backdoor malware

Infrastructure

halcyon.ai itdesk.com cisa.gov

7 Actions on Objectives

Capability (Techniques)

T1020 T1052.001 T1567.002 T1486

Capability (Malware)

Akira BOLDMOVE Backdoor malware

Infrastructure

halcyon.ai itdesk.com cisa.gov