Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

APT18 (threat actor)

Risk

Critical

29 techniques 53 tools/malware 10 vulnerabilities 38 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.003

Virtual Private Server resource development

T1583.004

Server resource development

T1584

Compromise Infrastructure resource development

T1584.001

Domains resource development

T1584.003

Virtual Private Server resource development

T1584.004

Server resource development

›

3 Delivery

No data

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1053.002

At execution

T1059

Command and Scripting Interpreter execution

T1059.003

Windows Command Shell execution

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2019-19781

CVE CVE-2020-10189

CVE CVE-2022-42475

CVE CVE-2024-3400

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

›

5 Installation

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1133

External Remote Services persistence

T1547

Boot or Logon Autostart Execution persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1071.002

File Transfer Protocols command and control

T1071.003

Mail Protocols command and control

T1071.004

DNS command and control

T1071.005

Publish/Subscribe Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1027.013

Encrypted/Encoded File stealth

T1070

Indicator Removal stealth

T1070.004

File Deletion stealth

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (53)

APT38 AppleJeus BRICKSTORM BlackEnergy Carbon Cobalt Cobalt Strike Covenant Dark Emissary Epic GitHub Global HTTPBrowser Havoc KONNI Kazuar Kimsuky Latrodectus Leverage LockBit Machete MuddyWater Mythic NETWIRE Netwire OilRig Payload Pisloader PlugX QakBot REvil Raccoon Raccoon Stealer ReGeorg RedCurl RedLine SUNBURST ShadowPad Sliver Sofacy SolarWinds Trojan Tsunami Turla Windows Command Shell Winnti curl gh0st RAT hcdLoader phishing reGeorg route

Indicators of Compromise (38)

Domain

NLog.config tbd.TITLE.Connect TEMP.Zagros TEMP.Periscope aqdrmf-rymPhb-ibnC6b.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-SfQLQb-bMcfAe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-OWB6Me.aqdrmf +27 more

Filename

at.exe Node.js cmd.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Exploitation (12)

M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +7 more

Installation (5)

M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (14)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +9 more

Detection Coverage

29 strategies

5/7 stages covered

Weaponization (8)

DET0838 Detection of Virtual Private Server DET0854 Detection of Virtual Private Server DET0863 Detection of Domains DET0871 Detection of Server DET0874 Detection of Server +3 more

Exploitation (4)

DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0333 Cross-Platform Detection of Scheduled Ta... DET0516 Behavioral Detection of Command and Scri...

Installation (5)

DET0274 Boot or Logon Autostart Execution Detect... DET0354 Behavior-chain detection for T1133 Exter... DET0365 Detect Registry and Startup Folder Persi... DET0370 Recursive Enumeration of Files and Direc... DET0525 System Discovery via Native and Remote U...

Command & Control (7)

DET0002 Behavioral Detection of Publish/Subscrib... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0135 Detection of Mail Protocol-Based C2 Acti... DET0400 Behavioral Detection of DNS Tunneling an... +2 more

Actions on Objectives (5)

DET0087 Encrypted or Encoded File Payload Detect... DET0140 Behavioral Detection of Malicious File D... DET0184 Behavioral Detection of Indicator Remova... DET0378 Behavioral Detection of Obfuscated Files... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

APT18

Type: Unknown Active

TG-0416 Dynamite Panda Threat Group-0416 SCANDIUM PLA Navy +14 more

Infrastructure 35 IOC(s)

50%

Domain

NLog.config tbd.TITLE.Connect TEMP.Zagros TEMP.Periscope aqdrmf-rymPhb-ibnC6b.aqdrmf +30

Artifacts (3)

at.exe Node.js cmd.exe

Capability

67%

29 technique(s) 53 tool(s)/malware 10 CVE(s)

APT38 AppleJeus BRICKSTORM BlackEnergy Carbon Cobalt Cobalt Strike Covenant +45

command and control

T1071 T1071.001 T1071.002 T1071.003 +3

discovery

T1082 T1083

execution

T1053 T1053.002 T1059 T1059.003

persistence

T1133 T1547 T1547.001

Victim

70%

Targeted Sectors

government financial-services telecommunications non-profit defense healthcare manufacturing energy education media pharmaceutical information-technology aerospace transportation critical-infrastructure maritime legal-services utilities aviation think-tank mining chemical construction retail hospitality nuclear

Targeted Countries

US CN RU UA SA IN KR PK AE IL KP TW IR VN MX ES AZ AU NL BY GB TR LB JP RO

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.003 T1583.004 T1584

Capability (Malware)

APT38 AppleJeus BRICKSTORM

Infrastructure

NLog.config tbd.TITLE.Connect TEMP.Zagros

4 Exploitation

Capability (Techniques)

T1053 T1053.002 T1059 T1059.003

Capability (Malware)

APT38 AppleJeus BRICKSTORM

Infrastructure

NLog.config tbd.TITLE.Connect TEMP.Zagros

5 Installation

Capability (Techniques)

T1082 T1083 T1133 T1547 T1547.001

Capability (Malware)

APT38 AppleJeus BRICKSTORM

Infrastructure

NLog.config tbd.TITLE.Connect TEMP.Zagros

6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1071.002 T1071.003 T1071.004

Capability (Malware)

APT38 AppleJeus BRICKSTORM

Infrastructure

NLog.config tbd.TITLE.Connect TEMP.Zagros