Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

d1r (threat actor)

Risk

Critical

14 techniques 44 tools/malware 7 vulnerabilities 38 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1204

User Execution execution

CVE CVE-2023-21529

CVE CVE-2024-1708

CVE CVE-2026-20131

CVE CVE-2026-20316

CVE CVE-2026-33825

CVE CVE-2026-48027

CVE CVE-2026-50751

›

5 Installation

T1040

Network Sniffing credential access

T1110

Brute Force credential access

T1136

Create Account persistence

›

6 Command & Control

T1185

Browser Session Hijacking collection

T1560.002

Archive via Library collection

T1071

Application Layer Protocol command and control

T1105

Ingress Tool Transfer command and control

T1021.001

Remote Desktop Protocol lateral movement

›

7 Actions on Objectives

T1486

Data Encrypted for Impact impact

T1561

Disk Wipe impact

T1036

Masquerading stealth

T1055

Process Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (44)

Akira Akira ransomware Alphv Anubis Atmosphere BRAIN Babuk Babuk Ransomware Bert BlackCat Chaos Clop Clop Ransomware ConnectWise Conti Dark DragonForce Embargo Fog ransomware FunkSec GitHub Global Gunra Handala KryBit LockBit Lynx Matrix Medusa Neuron OrBit PLAY Payload Payload Qilin RALord RansomHub Royal ScreenConnect Solar Telegram VanHelsing inter phishing

Indicators of Compromise (38)

Domain

6.Welsh 7.LeGates 8.Mistlberger journal.pone FalconFeeds.io j.cub journal.pbio j.physbeh +18 more

Email Address

adsteele@cpp.edu plosone@plos.org onepress@plos.org

Filename

RN2015TOYT7LNK682.pdf RdrCEF.exe cmd.exe AcroRd32.exe

MD5 Hash

BAE868B4781E28FC7ABAB8AF8B440075 1D7F3D5A6B5E9ABE240F99D2A60EA1F5

SHA-1 Hash

0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0 CE338828149963DCEA4CD26BB86F0363B4CA0BA5

SHA-256 Hash

52df60e4cb9a5926db3e9a69b04ccbade56f6f90b2ec94e0caaa4fa4f613a0a4

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (11)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +6 more

Installation (8)

M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation +3 more

Command & Control (11)

M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +6 more

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1038 Execution Prevention +5 more

Detection Coverage

14 strategies

4/7 stages covered

Exploitation (2)

DET0094 Cross-Platform Behavioral Detection of S... DET0478 User Execution – multi-surface behavior...

Installation (3)

DET0314 Detection Strategy for Network Sniffing... DET0463 Brute Force Authentication Failures with... DET0583 Detection Strategy for T1136 - Create Ac...

Command & Control (5)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0268 Detect Archiving via Library (T1560.002) DET0327 Multi-event Detection Strategy for RDP-B... DET0444 Detection of Command and Control Over Ap... DET0507 Detect browser session hijacking via pri...

Actions on Objectives (4)

DET0127 Behavioral Detection of Masquerading Acr... DET0137 Detection Strategy for Disk Wipe via Dir... DET0215 Detection of Multi-Platform File Encrypt... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

d1r

Type: Criminal Sophistication: Medium First seen: 2026 Active

tracked as Jul 6 2026 Bjorka SkyWave +23 more

Infrastructure 26 IOC(s)

50%

Domain

6.Welsh 7.LeGates 8.Mistlberger journal.pone FalconFeeds.io +21

Artifacts (12)

adsteele@cpp.edu plosone@plos.org onepress@plos.org RN2015TOYT7LNK682.pdf RdrCEF.exe cmd.exe +6

Capability

50%

14 technique(s) 44 tool(s)/malware 7 CVE(s)

Akira Akira ransomware Alphv Anubis Atmosphere BRAIN Babuk Babuk Ransomware +36

collection

T1185 T1560.002

command and control

T1071 T1105

credential access

T1040 T1110

execution

T1053 T1204

Victim

70%

Targeted Sectors

financial-services government healthcare defense telecommunications manufacturing transportation education construction retail aerospace aviation critical-infrastructure information-technology energy chemical legal-services media non-profit oil-gas hospitality

Targeted Countries

US IL BR IR IN AU GB AE JP RO PK CA FR RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2026-07-13

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1053 T1204

Capability (Malware)

Akira Akira ransomware Alphv

Infrastructure

6.Welsh 7.LeGates 8.Mistlberger

5 Installation

Capability (Techniques)

T1040 T1110 T1136

Capability (Malware)

Akira Akira ransomware Alphv

Infrastructure

6.Welsh 7.LeGates 8.Mistlberger

6 Command & Control

Capability (Techniques)

T1185 T1560.002 T1071 T1105 T1021.001

Capability (Malware)

Akira Akira ransomware Alphv

Infrastructure

6.Welsh 7.LeGates 8.Mistlberger

7 Actions on Objectives

Capability (Techniques)

T1486 T1561

Capability (Malware)

Akira Akira ransomware Alphv

Infrastructure

6.Welsh 7.LeGates 8.Mistlberger