Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

codemado (threat actor)

Risk

Medium

1 techniques 49 tools/malware 0 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Delivery

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (49)

AsyncRAT Backdoor malware Backdoors BlueSky C2 infrastructure CALENDAR Cursor Custom tools Dark Dindoor Evilginx GitHub Global Group Policy Guard Infostealer Infostealer malware Legitimate Software MESHAGENT Magniber Magniber Ransomware Microsoft Defender XDR Microsoft Teams MinIO Mirage Mirage Kitten Nexus Nimbus Manticore PLAY Phishing emails Pink PowerShell PowerShell commands PsExec Remote Monitoring and Management tools STOP ScreenConnect ScreenConnect client Smoke Sandstorm Spark Spear-phishing Tactical RMM UNC1549 Unknown Void Wevtutil Wiper malware phishing route

Indicators of Compromise (40)

Domain

Mallory.ai document.addEventListener Array.isArray window.addEventListener document.createElement document.querySelector e.style e.startsWith +32 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

7 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Detection Coverage

1 strategies

1/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

codemado

Type: Unknown Active

tracked as Eagle Werewolf Void Blizzard Laundry Bear UNC1549 +5 more

Infrastructure 40 IOC(s)

50%

Domain

Mallory.ai document.addEventListener Array.isArray window.addEventListener document.createElement +35

Capability

50%

1 technique(s) 49 tool(s)/malware

AsyncRAT Backdoor malware Backdoors BlueSky C2 infrastructure CALENDAR Cursor Custom tools +41

initial access

T1566.001

Victim

70%

Targeted Sectors

financial-services government healthcare construction retail defense hospitality media aerospace oil-gas

Targeted Countries

United States of America Australia Brazil Canada France Norway Poland Singapore Slovenia Spain Switzerland United Kingdom of Great Britain and Northern Ireland

Diamond Model Meta-Features

Phase

Delivery

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

AsyncRAT Backdoor malware Backdoors

Infrastructure

Mallory.ai document.addEventListener Array.isArray