Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Monty Spider (threat actor)

Risk

High

7 techniques 58 tools/malware 1 vulnerabilities 36 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.006

Python execution

T1204.002

Malicious File execution

CVE CVE-2021-35211

›

5 Installation

No data

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1486

Data Encrypted for Impact impact

T1064

Stage risk: Critical High Medium None

Tools & Malware (58)

ANDROMEDA AndroMut Backdoor malware BitPaymer Cobalt Crimson CryptoLocker Cutwail Dark Dridex Emotet Emotet FlawedAmmyy FlawedAmmyy RAT FlawedGrace FlowerPippi Gelsemium Gelup Get2 Global Hades Hafnium Imperial Kitten Infy InvisiMole ItaDuke Jackal Jaff Kimsuky Labyrinth Chollima Locky Lumma Stealer MINEBRIDGE Mango MuddyWater NOTROBIN Necurs Nitro Phoenix PlugX RMS RAT Royal SDBbot ServHelper Shark Siamesekitten Snake Spirlin TeamSpy The Trick Tsunami Turla UNC1549 VICEROY Void Wicked Zeus phishing

Indicators of Compromise (36)

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles TEMP.Zagros Temp.Zagros TEMP.Periscope Temp.Overboard TEMP.HEX +28 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

12 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (6)

M1017 User Training M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1047 Audit +1 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1040 Behavior Prevention on Endpoint M1053 Data Backup

Detection Coverage

6 strategies

4/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0063 Cross-Platform Behavioral Detection of P... DET0294 User Execution – Malicious File via down...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0215 Detection of Multi-Platform File Encrypt...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

70%

Monty Spider

Type: Nation-State Active

Spandex Tempest tracked as malicious actors APT groups hackers +2 more

Infrastructure 36 IOC(s)

50%

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles TEMP.Zagros Temp.Zagros +31

Capability

50%

7 technique(s) 58 tool(s)/malware 1 CVE(s)

ANDROMEDA AndroMut Backdoor malware BitPaymer Cobalt Crimson CryptoLocker Cutwail +50

T1064

command and control

T1071.001 T1105

execution

T1059.006 T1204.002

impact

T1486

Victim

70%

Targeted Sectors

financial-services healthcare retail government media non-profit information-technology education hospitality think-tank

Targeted Countries

CN US KR IL ES MX IT TW RU KP IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

ANDROMEDA AndroMut Backdoor malware

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles

4 Exploitation

Capability (Techniques)

T1059.006 T1204.002

Capability (Malware)

ANDROMEDA AndroMut Backdoor malware

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles

6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

ANDROMEDA AndroMut Backdoor malware

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles

7 Actions on Objectives

Capability (Techniques)

T1486

Capability (Malware)

ANDROMEDA AndroMut Backdoor malware

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles