Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Windshift (threat actor)

Risk

Critical

48 techniques 42 tools/malware 5 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1584

Compromise Infrastructure resource development

T1584.001

Domains resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

T1566.003

Spearphishing via Service initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059

Command and Scripting Interpreter execution

T1059.005

Visual Basic execution

T1204

User Execution execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

CVE CVE-2024-3400

CVE CVE-2025-55182

CVE CVE-2025-60787

CVE CVE-2025-8518

CVE CVE-2026-31431

›

5 Installation

T1040

Network Sniffing credential access

T1033

System Owner/User Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1518

Software Discovery discovery

T1518.001

Security Software Discovery discovery

T1547

Boot or Logon Autostart Execution persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1036.001

Invalid Code Signature stealth

T1036.002

Right-to-Left Override stealth

T1036.003

Rename Legitimate Utilities stealth

T1036.004

Masquerade Task or Service stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1036.006

Space after Filename stealth

T1036.007

Double File Extension stealth

T1036.008

Masquerade File Type stealth

T1036.009

Break Process Trees stealth

T1036.010

Masquerade Account Name stealth

T1036.011

Overwrite Process Arguments stealth

T1036.012

Browser Fingerprint stealth

T1407

T1420

T1429

T1521

T1533

T1627

T1627.001

T1628.003

Stage risk: Critical High Medium None

Tools & Malware (42)

AppleSeed Bahamut BeaverTail Bisonal Cobalt Dark DarkGate DarkTortilla DarkWatchman DynoWiper Epic Flagpro FoggyWeb GitHub GlassWorm Global Lazyscripter Malicious files Octopus OilRig Payload Payload Phoenix Pony Raindrop Ramsay Ryuk SUNBURST Saint Bot TeamTNT TrickBot Unknown Velociraptor WhisperGate WildFire WindTail WindTape XCSSET metasploit phishing rock route

Indicators of Compromise (40)

Domain

cisa.gov OSX.WindTail index.mdx Salesforce.com NLog.config tbd.TITLE.Connect MiroTalk.dmg flux2key.com +11 more

Filename

logd.zip schtask.exe schtask2.exe MiroTalk.msi dump64.exe keybaged.zip English.rtf mcworker.zip +5 more

SHA-256 Hash

ce8e01373499b539f4746c0e68c850357476abe36b12834f507f9ba19af3d4f9 1fbfbaefd50627796e7f16b8cc2b81ffbc5effcb33b64cc8e349e44b5d5d3ee8 e0fdcb5e0215f9fae485fbfcd615c79b85806827e461bca2e1c00c82e83281dc 1de218e45cdf069c10d1a8735d82688b8964261a5efe3b6560e0fdcfa3c44c1d

IPv4 Address

109.235.51.110 109.235.51.153 109.235.50.191 185.25.50.189

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

23 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Exploitation (12)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention +7 more

Installation (4)

M1018 User Account Management M1030 Network Segmentation M1032 Multi-factor Authentication M1041 Encrypt Sensitive Information

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (9)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1028 Operating System Configuration M1038 Execution Prevention +4 more

Detection Coverage

40 strategies

6/7 stages covered

Weaponization (4)

DET0863 Detection of Domains DET0885 Detection of Compromise Infrastructure DET0892 Detection of Domains DET0895 Detection of Acquire Infrastructure

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0115 Detection Strategy for Spearphishing via... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (6)

DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0294 User Execution – Malicious File via down... DET0364 Behavioral Detection Strategy for WMI Ex... DET0478 User Execution – multi-surface behavior... +1 more

Installation (8)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0274 Boot or Logon Autostart Execution Detect... DET0314 Detection Strategy for Network Sniffing... +3 more

Command & Control (3)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (14)

DET0005 Renamed Legitimate Utility Execution wit... DET0031 Invalid Code Signature Execution Detecti... DET0117 Detection of Masqueraded Tasks or Servic... DET0127 Behavioral Detection of Masquerading Acr... DET0164 Detection Strategy for Overwritten Proce... +9 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Windshift

Type: Unknown Active

Bahamut Offshore APT organization from South Asia Windy Phoenix tracked as forecasts +4 more

Infrastructure 23 IOC(s)

50%

Domain

cisa.gov OSX.WindTail index.mdx Salesforce.com NLog.config +14

IPv4 Address

109.235.51.110 109.235.51.153 109.235.50.191 185.25.50.189

Artifacts (17)

logd.zip schtask.exe schtask2.exe MiroTalk.msi dump64.exe keybaged.zip +11

Capability

66%

48 technique(s) 42 tool(s)/malware 5 CVE(s)

AppleSeed Bahamut BeaverTail Bisonal Cobalt Dark DarkGate DarkTortilla +34

T1407 T1420 T1429 T1521 +4

command and control

T1071 T1071.001 T1105

credential access

T1040

discovery

T1033 T1057 T1082 T1518 +1

Victim

70%

Targeted Sectors

government critical-infrastructure energy nuclear transportation media financial-services maritime education mining non-profit

Targeted Countries

middle_east UA AE KP PK IN VN EG MX RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1584 T1584.001

Capability (Malware)

AppleSeed Bahamut BeaverTail

Infrastructure

cisa.gov OSX.WindTail index.mdx

3 Delivery

Capability (Techniques)

T1189 T1566 T1566.001 T1566.002 T1566.003

Capability (Malware)

AppleSeed Bahamut BeaverTail

Infrastructure

cisa.gov OSX.WindTail index.mdx

4 Exploitation

Capability (Techniques)

T1047 T1059 T1059.005 T1204 T1204.001

Capability (Malware)

AppleSeed Bahamut BeaverTail

Infrastructure

cisa.gov OSX.WindTail index.mdx

5 Installation

Capability (Techniques)

T1040 T1033 T1057 T1082 T1518

Capability (Malware)

AppleSeed Bahamut BeaverTail

Infrastructure

cisa.gov OSX.WindTail index.mdx

6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1105

Capability (Malware)

AppleSeed Bahamut BeaverTail

Infrastructure

cisa.gov OSX.WindTail index.mdx