Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Wisteria Tsunami (threat actor)

Risk

Medium

5 techniques 46 tools/malware 1 vulnerabilities 4 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2017-0005

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1059 - Command and Scripting Interpreter

T1078 - Valid Accounts

T1086 - PowerShell

T1105 - Ingress Tool Transfer

T1134 - Exfiltration Over Alternative Protocols

Stage risk: Critical High Medium None

Tools & Malware (46)

Agent Tesla Athena BANSHEE BARIUM BLINDINGCAN BeaverTail BirdCall Citrine Sleet Cobalt Conti Covenant Crimson Dark Emissary Ghost RAT GitHub Global Hafnium Imperial Kitten InvisibleFerret Jackal Kimsuky Kraken Labyrinth Chollima Luna Lynx Mango Matrix Moonstone Sleet Mythic OceanLotus PINEFLOWER PXA Stealer Pink SUNBURST Sednit Smoke Sandstorm Sofacy SolarWinds Tsunami Turla Void WAVESHAPER Wicked Wingbird Winnti

Indicators of Compromise (4)

Domain

360.net TEMP.Zagros TEMP.Periscope MicrosoftMapping.json

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Wisteria Tsunami

Type: Unknown Active

DEV-0605 CyberRoot MintedSoil tracked as SamSam

Infrastructure 4 IOC(s)

50%

Domain

360.net TEMP.Zagros TEMP.Periscope MicrosoftMapping.json

Capability

50%

5 technique(s) 46 tool(s)/malware 1 CVE(s)

Agent Tesla Athena BANSHEE BARIUM BLINDINGCAN BeaverTail BirdCall Citrine Sleet +38

T1059 - Command and Scripting Interpreter T1078 - Valid Accounts T1086 - PowerShell T1105 - Ingress Tool Transfer +1

Victim

70%

Targeted Sectors

financial-services government defense telecommunications media non-profit education energy think-tank pharmaceutical manufacturing chemical information-technology gaming maritime legal-services mining utilities

Targeted Countries

IN IR CN KP RU IL US GB UA VN TR LB KR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges