Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

karma (threat actor)

Risk

High

6 techniques 48 tools/malware 1 vulnerabilities 12 IOCs 3/7 stages covered Deepest: Installation

1 Reconnaissance

No data

›

2 Weaponization

T1585.001

Social Media Accounts resource development

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2024-42618

›

5 Installation

T1557

Adversary-in-the-Middle credential access

T1557.001

Name Resolution Poisoning and SMB Relay credential access

T1557.002

ARP Cache Poisoning credential access

T1557.003

DHCP Spoofing credential access

T1557.004

Evil Twin credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (48)

APT38 Akira AppleJeus BARIUM Backdoors BlackByte BlackByte Ransomware Carbanak Chimera Cobalt Confucius Conti Custom malware Custom tools Dark DarkHotel EVILNUM Ferocious Global Guard Hafnium Handala Karma Kimsuky Machete Medusa Moonstone Sleet MuddyWater Naikon Nexus Octopus OilRig Open-source tools PLAY PoisonIvy Poseidon REvil RedCurl Remote access tools Rogue SideWinder Trojan Turla Void Winnti Zero-day exploits gcman phishing

Indicators of Compromise (12)

Domain

TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex TEMP.hermit TEMP.Reaper TEMP.Isotope +2 more

Email Address

rocke@live.cn cve@mitre.org

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

8 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Installation (7)

M1017 User Training M1030 Network Segmentation M1031 Network Intrusion Prevention M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +2 more

Detection Coverage

6 strategies

2/7 stages covered

Weaponization (1)

DET0851 Detection of Social Media Accounts

Installation (5)

DET0296 Detect Adversary-in-the-Middle via Netwo... DET0379 Detect Evil Twin Wi-Fi Access Points on... DET0387 Detect ARP Cache Poisoning Across Linux,... DET0462 Detect LLMNR/NBT-NS Poisoning and SMB Re... DET0468 Detect DHCP Spoofing Across Linux, Windo...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

karma

Type: Criminal Sophistication: Medium First seen: 2021 Active

tracked as Sandworm Team Operation Cleaver Shell Crew WebMasters +6 more

Infrastructure 10 IOC(s)

50%

Domain

TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex +5

Artifacts (2)

rocke@live.cn cve@mitre.org

Capability

50%

6 technique(s) 48 tool(s)/malware 1 CVE(s)

APT38 Akira AppleJeus BARIUM Backdoors BlackByte BlackByte Ransomware Carbanak +40

credential access

T1557 T1557.001 T1557.002 T1557.003 +1

resource development

T1585.001

Victim

70%

Targeted Sectors

government financial-services telecommunications defense healthcare education manufacturing non-profit energy media critical-infrastructure pharmaceutical aviation hospitality aerospace retail information-technology think-tank transportation mining chemical gaming legal-services nuclear entertainment oil-gas maritime construction utilities

Targeted Countries

US CN RU IR VN JP IL GB AU SA PK TW AE UA SG KR IN DE BY TR MX ES PL CA RO FR NG KP IT LB AZ KZ

Diamond Model Meta-Features

Phase

Installation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2021-10-04

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1585.001

Capability (Malware)

APT38 Akira AppleJeus

Infrastructure

TEMP.Veles TEMP.Zagros TEMP.Jumper

5 Installation

Capability (Techniques)

T1557 T1557.001 T1557.002 T1557.003 T1557.004

Capability (Malware)

APT38 Akira AppleJeus

Infrastructure

TEMP.Veles TEMP.Zagros TEMP.Jumper