Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Lotus Blossom (threat actor)

Risk

Critical

27 techniques 55 tools/malware 2 vulnerabilities 16 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588.002

Tool resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566

Phishing initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

CVE CVE-2017-11882

CVE CVE-2025-22457

›

5 Installation

T1539

Steal Web Session Cookie credential access

T1012

Query Registry discovery

T1016

System Network Configuration Discovery discovery

T1016.001

Internet Connection Discovery discovery

T1018

Remote System Discovery discovery

T1046

Network Service Discovery discovery

T1049

System Network Connections Discovery discovery

T1083

File and Directory Discovery discovery

T1087.001

Local Account discovery

T1087.002

Domain Account discovery

T1482

Domain Trust Discovery discovery

T1543.003

Windows Service persistence

›

6 Command & Control

T1074.001

Local Data Staging collection

T1560

Archive Collected Data collection

T1560.001

Archive via Utility collection

T1560.003

Archive via Custom Method collection

T1090.001

Internal Proxy command and control

T1090.003

Multi-hop Proxy command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1553

Subvert Trust Controls defense impairment

T1134

Access Token Manipulation stealth

T1140

Deobfuscate/Decode Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (55)

APT38 Akira AndroRAT AppleJeus Backdoors Bahamut BlackByte CVE-2017-11882 Carbanak Chrysalis Chrysalis Backdoor Cobalt Confucius CrimsonRAT Custom backdoors Custom malware Custom tools Dark DarkHotel Elise Elise Backdoor Emissary Global Guard Hafnium Hannotog Hunter InvisiMole Kimsuky Lstudio Machete Medusa Mimikatz MuddyWater Naikon Nexus Octopus OilRig Open-source tools PowerShell Remote access tools Sagerunex Sagerunex backdoor Sednit ShadowPad Sofacy StrongPity Trojan Turla Void WildFire Winnti Zebrocy certutil phishing

Indicators of Compromise (16)

Domain

TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex file.io TEMP.Isotope TEMP.MixMaster +4 more

Email Address

rocke@live.cn

Filename

certutil.exe gup.exe Certutil.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (9)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1048 Application Isolation and Sandboxing +4 more

Exploitation (4)

M1018 User Account Management M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Installation (13)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1028 Operating System Configuration M1030 Network Segmentation +8 more

Command & Control (3)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit

Actions on Objectives (6)

M1018 User Account Management M1024 Restrict Registry Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +1 more

Detection Coverage

27 strategies

6/7 stages covered

Weaponization (1)

DET0852 Detection of Tool

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0364 Behavioral Detection Strategy for WMI Ex...

Installation (12)

DET0007 Detection of Domain Trust Discovery via... DET0129 Domain Account Enumeration Across Platfo... DET0195 Behavioral Detection of System Network C... DET0209 Detection of Registry Query for Environm... DET0303 Local Account Enumeration Across Host Pl... +7 more

Command & Control (7)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0075 Internal Proxy Behavior via Lateral Host... DET0261 Detection of Local Data Staging Prior to... DET0298 Detect Archiving via Utility (T1560.001) DET0359 Multi-hop Proxy Behavior via Relay Node... +2 more

Actions on Objectives (4)

DET0275 Detect Adversary Deobfuscation or Decodi... DET0280 Behavior-Based Registry Modification Det... DET0283 Behavior-chain detection for T1134 Acces... DET0452 Detect Subversion of Trust Controls via...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Lotus Blossom

Type: Unknown Active

DRAGONFISH Spring Dragon RADIUM Raspberry Typhoon Bilbug +89 more

Infrastructure 12 IOC(s)

50%

Domain

TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex +7

Artifacts (4)

rocke@live.cn certutil.exe gup.exe Certutil.exe

Capability

81%

27 technique(s) 55 tool(s)/malware 2 CVE(s)

APT38 Akira AndroRAT AppleJeus Backdoors Bahamut BlackByte CVE-2017-11882 +47

collection

T1074.001 T1560 T1560.001 T1560.003

command and control

T1090.001 T1090.003 T1105

credential access

T1539

defense impairment

T1112 T1553

Victim

70%

Targeted Sectors

defense government telecommunications financial-services education healthcare non-profit manufacturing energy media critical-infrastructure aerospace think-tank pharmaceutical aviation hospitality transportation retail chemical maritime legal-services information-technology mining gaming utilities nuclear entertainment oil-gas construction

Targeted Countries

CN US RU UA IL VN TW AE JP PK IR PL BY IN SA KR GB AU TR DE LB KZ SG IT FR MX ES CA IQ RO NG KP AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.002

Capability (Malware)

APT38 Akira AndroRAT

Infrastructure

TEMP.Veles TEMP.Zagros TEMP.Jumper

3 Delivery

Capability (Techniques)

T1189 T1566

Capability (Malware)

APT38 Akira AndroRAT

Infrastructure

TEMP.Veles TEMP.Zagros TEMP.Jumper

4 Exploitation

Capability (Techniques)

T1047

Capability (Malware)

APT38 Akira AndroRAT

Infrastructure

TEMP.Veles TEMP.Zagros TEMP.Jumper

5 Installation

Capability (Techniques)

T1539 T1012 T1016 T1016.001 T1018

Capability (Malware)

APT38 Akira AndroRAT

Infrastructure

TEMP.Veles TEMP.Zagros TEMP.Jumper

6 Command & Control

Capability (Techniques)

T1074.001 T1560 T1560.001 T1560.003 T1090.001

Capability (Malware)

APT38 Akira AndroRAT

Infrastructure

TEMP.Veles TEMP.Zagros TEMP.Jumper