Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

DragonOK (threat actor)

Risk

Critical

15 techniques 51 tools/malware 5 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.003

Virtual Private Server resource development

T1583.004

Server resource development

T1584

Compromise Infrastructure resource development

T1584.001

Domains resource development

T1584.003

Virtual Private Server resource development

T1584.004

Server resource development

›

3 Delivery

T1199

Trusted Relationship initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1203

Exploitation for Client Execution execution

T1204.001

Malicious Link execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2015-1641

CVE CVE-2025-55182

CVE CVE-2025-60787

CVE CVE-2025-8518

CVE CVE-2026-31431

›

5 Installation

No data

›

6 Command & Control

T1071

Application Layer Protocol command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (51)

AppDomainManager Backdoor malware Backdoors CVE-2015-1641 Carbon Custom tools Dark DragonForce FormerFirstRAT GOST GitHub Global HelloBridge IsSpace Leverage Lynx Metasploit NFlog NewCT OceanLotus Payload Payload PhantomCore Phishing campaigns Phishing emails PlugX Poison Ivy PoisonIvy PortDoor PowerShell Rambo Rambo Backdoor Rootkit STOP SentinelOne SkyWave SysGet Tasklist TidePool Tidepool Velociraptor Vidar Vidar stealer WildFire Windows Command Shell XCSSET YARA metasploit npm packages phishing route

Indicators of Compromise (39)

Domain

data.index https.reweblink.com Sentire.asp trend.gogolekr.com cool.skywave.top 5.php www.sanseitime.com Openhunting.io +18 more

Filename

Adobe.exe bfsuc.exe notilv.exe filename.exe svchost.exe cmd.exe avp.exe

MD5 Hash

07660815420F6D5B2DCC0F63434A6C60 aa8ac5ed26b9bf4f8d3bd1b2dcaa82f6 4890c2d546fa48a536b75b48b17de023 fc1a8359e0f4cb8d60920dc066b8b21c 01234567890123456789012345678901 70efdf2ec9b086079795c442636b55fb

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (9)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1030 Network Segmentation M1031 Network Intrusion Prevention +4 more

Exploitation (8)

M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1038 Execution Prevention +3 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (4)

M1017 User Training M1040 Behavior Prevention on Endpoint M1047 Audit M1049 Antivirus/Antimalware

Detection Coverage

15 strategies

5/7 stages covered

Weaponization (8)

DET0838 Detection of Virtual Private Server DET0854 Detection of Virtual Private Server DET0863 Detection of Domains DET0871 Detection of Server DET0874 Detection of Server +3 more

Delivery (2)

DET0236 Detection Strategy for Spearphishing Att... DET0488 Detect abuse of Trusted Relationships (t...

Exploitation (3)

DET0066 User Execution – Malicious Link (click →... DET0287 Exploitation for Client Execution – cros... DET0514 Detection Strategy for Exploitation for...

Command & Control (1)

DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (1)

DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

70%

DragonOK

Type: Nation-State Active

DragonOK Moafee BRONZE OVERBROOK G0017 G0002 +4 more

Infrastructure 26 IOC(s)

50%

Domain

data.index https.reweblink.com Sentire.asp trend.gogolekr.com cool.skywave.top +21

Artifacts (13)

Adobe.exe bfsuc.exe notilv.exe filename.exe svchost.exe cmd.exe +7

Capability

53%

15 technique(s) 51 tool(s)/malware 5 CVE(s)

AppDomainManager Backdoor malware Backdoors CVE-2015-1641 Carbon Custom tools Dark DragonForce +43

command and control

T1071

execution

T1203 T1204.001

initial access

T1199 T1566.001

privilege escalation

T1068

Victim

70%

Targeted Sectors

telecommunications manufacturing government defense critical-infrastructure financial-services media aerospace

Targeted Countries

JP TW RU KR IR CN US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.003 T1583.004 T1584

Capability (Malware)

AppDomainManager Backdoor malware Backdoors

Infrastructure

data.index https.reweblink.com Sentire.asp

3 Delivery

Capability (Techniques)

T1199 T1566.001

Capability (Malware)

AppDomainManager Backdoor malware Backdoors

Infrastructure

data.index https.reweblink.com Sentire.asp

4 Exploitation

Capability (Techniques)

T1203 T1204.001 T1068

Capability (Malware)

AppDomainManager Backdoor malware Backdoors

Infrastructure

data.index https.reweblink.com Sentire.asp

6 Command & Control

Capability (Techniques)

T1071

Capability (Malware)

AppDomainManager Backdoor malware Backdoors

Infrastructure

data.index https.reweblink.com Sentire.asp