Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Moonstone Sleet (threat actor)

Risk

100

Critical

55 techniques 57 tools/malware 10 vulnerabilities 39 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589

Gather Victim Identity Information reconnaissance

T1589.002

Email Addresses reconnaissance

T1591

Gather Victim Org Information reconnaissance

T1598

Phishing for Information reconnaissance

T1598.003

Spearphishing Link reconnaissance

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.003

Virtual Private Server resource development

T1585

Establish Accounts resource development

T1585.001

Social Media Accounts resource development

T1585.002

Email Accounts resource development

T1587

Develop Capabilities resource development

T1587.001

Malware resource development

T1608

Stage Capabilities resource development

T1608.001

Upload Malware resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1195

Supply Chain Compromise initial access

T1195.002

Compromise Software Supply Chain initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

T1566.003

Spearphishing via Service initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1129

Shared Modules execution

T1204

User Execution execution

T1204.002

Malicious File execution

T1569

System Services execution

T1569.002

Service Execution execution

CVE CVE-2024-21762

CVE CVE-2024-50623

CVE CVE-2024-55591

CVE CVE-2024-55956

CVE CVE-2024-57726

CVE CVE-2024-57727

CVE CVE-2024-57728

CVE CVE-2025-31324

CVE CVE-2026-25089

CVE CVE-2026-39808

›

5 Installation

T1003

OS Credential Dumping credential access

T1003.001

LSASS Memory credential access

T1555.003

Credentials from Web Browsers credential access

T1016

System Network Configuration Discovery discovery

T1033

System Owner/User Discovery discovery

T1082

System Information Discovery discovery

T1217

Browser Information Discovery discovery

T1547

Boot or Logon Autostart Execution persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1021

Remote Services lateral movement

T1091

Replication Through Removable Media lateral movement

›

7 Actions on Objectives

T1567.002

Exfiltration to Cloud Storage exfiltration

T1486

Data Encrypted for Impact impact

T1027

Obfuscated Files or Information stealth

T1027.009

Embedded Payloads stealth

T1027.013

Encrypted/Encoded File stealth

T1055

Process Injection stealth

T1078

Valid Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1050

T1060

Stage risk: Critical High Medium None

Tools & Malware (57)

APT38 Akira Anubis AppleJeus Bert BlackByte Carbanak Cobalt Comebacker Confucius Custom game-based malware loader Custom malware Custom ransomware DEVMAN Dark DragonForce Global Hunter Kimsuky Labyrinth Chollima LockBit MESHAGENT Malicious npm packages Medusa Microsoft Defender XDR Mimikatz Moonstone Sleet MuddyWater Naikon Nexus Octopus OilRig Open-source tools PLAY Payload Payload PowerShell PsExec PuTTY Qilin Qilin Ransomware Qilin ransomware RansomHub Remote access tools SafePay SmokeLoader SplitLoader SystemBC Trojanized PuTTY Tsunami Unknown Void Winnti YouieLoader npm packages phishing splitloader

Indicators of Compromise (39)

Domain

TEMP.Veles lazarus.day TEMP.hermit TEMP.Reaper TEMP.Isotope TEMP.MixMaster MicrosoftMapping.json agent.ashx +14 more

Email Address

rocke@live.cn

Filename

putty.exe adb.bin svchost.exe pwndll.dll u.bin delfi-tank-unity.exe procdump64.exe procdump.exe +3 more

SHA-256 Hash

cb97ec024c04150ad419d1af2d1eb66b5c48ab5f345409d9d791db574981a3fb cafaa7bc3277711509dc0800ed53b82f645e86c195e85fbf34430bbc75c39c24 70c5b64589277ace59db86d19d846a9236214b48aacabbaf880f2b6355ab5260 39d7407e76080ec5d838c8ebca5182f3ac4a5f416ff7bda9cbc4efffd78b4ff5 f59035192098e44b86c4648a0de4078edbe80352260276f4755d15d354f5fc58

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (3)

M1017 User Training M1054 Software Configuration M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (14)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +9 more

Exploitation (14)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more

Installation (12)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1025 Privileged Process Integrity +7 more

Command & Control (10)

M1018 User Account Management M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1034 Limit Hardware Installation +5 more

Actions on Objectives (13)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +8 more

Detection Coverage

53 strategies

7/7 stages covered

Reconnaissance (5)

DET0814 Detection of Email Addresses DET0823 Detection of Phishing for Information DET0841 Detection of Gather Victim Identity Info... DET0878 Detection of Spearphishing Link DET0890 Detection of Gather Victim Org Informati...

Weaponization (10)

DET0824 Detection of Upload Malware DET0835 Detection of Email Accounts DET0838 Detection of Virtual Private Server DET0839 Detection of Stage Capabilities DET0851 Detection of Social Media Accounts +5 more

Delivery (7)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0115 Detection Strategy for Spearphishing via... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... +2 more

Exploitation (9)

DET0018 Behavior-chain, platform-aware detection... DET0094 Cross-Platform Behavioral Detection of S... DET0279 Detection Strategy for System Services a... DET0294 User Execution – Malicious File via down... DET0421 Detection Strategy for System Services S... +4 more

Installation (9)

DET0013 Detection of Local Browser Artifact Acce... DET0037 Detect Suspicious Access to Browser Cred... DET0093 Behavioral Detection of User Discovery v... DET0195 Behavioral Detection of System Network C... DET0234 Credential Dumping via Sensitive Memory... +4 more

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0269 Behavioral Detection Strategy for Remote... DET0301 Removable Media Execution Chain Detectio... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (8)

DET0087 Encrypted or Encoded File Payload Detect... DET0214 Detection Strategy for Embedded Payloads DET0215 Detection of Multi-Platform File Encrypt... DET0275 Detect Adversary Deobfuscation or Decodi... DET0378 Behavioral Detection of Obfuscated Files... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Moonstone Sleet

Type: Unknown Active

Storm-1789 that combines many tried- tracked as North Korea APT38 +25 more

Infrastructure 22 IOC(s)

50%

Domain

TEMP.Veles lazarus.day TEMP.hermit TEMP.Reaper TEMP.Isotope +17

Artifacts (17)

rocke@live.cn putty.exe adb.bin svchost.exe pwndll.dll u.bin +11

Capability

72%

55 technique(s) 57 tool(s)/malware 10 CVE(s)

APT38 Akira Anubis AppleJeus Bert BlackByte Carbanak Cobalt +49

T1050 T1060

command and control

T1071 T1071.001 T1105

credential access

T1003 T1003.001 T1555.003

discovery

T1016 T1033 T1082 T1217

Victim

70%

Targeted Sectors

government financial-services defense manufacturing telecommunications healthcare education media non-profit critical-infrastructure transportation energy aerospace information-technology pharmaceutical aviation hospitality mining think-tank retail construction chemical gaming legal-services oil-gas maritime nuclear entertainment utilities

Targeted Countries

US CN RU IL KP IR GB JP AE VN AU SA TW IN PK DE UA KR CA SG IT BY TR FR MX ES PL RO NG LB AZ KZ BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1589.002 T1591 T1598 T1598.003

Capability (Malware)

APT38 Akira Anubis

Infrastructure

TEMP.Veles lazarus.day TEMP.hermit

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.003 T1585 T1585.001

Capability (Malware)

APT38 Akira Anubis

Infrastructure

TEMP.Veles lazarus.day TEMP.hermit

3 Delivery

Capability (Techniques)

T1189 T1195 T1195.002 T1566 T1566.001

Capability (Malware)

APT38 Akira Anubis

Infrastructure

TEMP.Veles lazarus.day TEMP.hermit

4 Exploitation

Capability (Techniques)

T1053 T1053.005 T1059 T1059.001 T1129

Capability (Malware)

APT38 Akira Anubis

Infrastructure

TEMP.Veles lazarus.day TEMP.hermit

5 Installation

Capability (Techniques)

T1003 T1003.001 T1555.003 T1016 T1033

Capability (Malware)

APT38 Akira Anubis

Infrastructure

TEMP.Veles lazarus.day TEMP.hermit

6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1105 T1021 T1091

Capability (Malware)

APT38 Akira Anubis

Infrastructure

TEMP.Veles lazarus.day TEMP.hermit

7 Actions on Objectives

Capability (Techniques)

T1567.002 T1486

Capability (Malware)

APT38 Akira Anubis

Infrastructure

TEMP.Veles lazarus.day TEMP.hermit