Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Carbanak (threat actor)

Risk

Critical

46 techniques 63 tools/malware 6 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1583.001

Domains resource development

T1583.003

Virtual Private Server resource development

T1583.004

Server resource development

T1584

Compromise Infrastructure resource development

T1584.001

Domains resource development

T1584.003

Virtual Private Server resource development

T1588

Obtain Capabilities resource development

T1588.002

Tool resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1059.003

Windows Command Shell execution

CVE CVE-2015-1770

CVE CVE-2015-2426

CVE CVE-2025-55182

CVE CVE-2025-60787

CVE CVE-2025-8518

CVE CVE-2026-31431

›

5 Installation

T1003

OS Credential Dumping credential access

T1012

Query Registry discovery

T1057

Process Discovery discovery

T1136

Create Account persistence

T1543

Create or Modify System Process persistence

T1543.003

Windows Service persistence

T1547

Boot or Logon Autostart Execution persistence

›

6 Command & Control

T1056

Input Capture collection

T1056.001

Keylogging collection

T1113

Screen Capture collection

T1114

Email Collection collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1102

Web Service command and control

T1102.002

Bidirectional Communication command and control

T1132

Data Encoding command and control

T1219

Remote Access Tools command and control

T1573

Encrypted Channel command and control

T1573.001

Symmetric Cryptography command and control

T1021

Remote Services lateral movement

›

7 Actions on Objectives

T1686

Disable or Modify System Firewall defense impairment

T1030

Data Transfer Size Limits exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1485

Data Destruction impact

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1036.004

Masquerade Task or Service stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1055

Process Injection stealth

T1070

Indicator Removal stealth

T1078

Valid Accounts stealth

T1218

System Binary Proxy Execution stealth

T1218.011

Rundll32 stealth

Stage risk: Critical High Medium None

Tools & Malware (63)

Agent ORM Ammy Admin AsyncRAT Backdoor Batel Bahamut Bateleur Bateleur JScript Backdoor CHOPSTICK CVE-2012-2539 and CVE-2012-0158 Carbanak Carbanak malware Carberp Carbon Chaos Cobalt Cobalt Strike Crisis Custom malware Dark DarkHotel DarkSide FastCash GGLdr GitHub Global JS FLash Keyhole Leverage Lynx MBR Eraser Maze Mimikatz Netscan Open-source tools Payload Phishing emails PlugX PsExec REvil REvil ransomware Remcos Remote access tools Reynolds Rogue Rundll32 SSHd with BackDoor STOP Scheduled Tasks Sekur SentinelOne SoftPerfect Network Scanner Spear-phishing Spear-phishing emails Stealc Trojan Unknown VB Flash Velociraptor Windows Command Shell metasploit netsh phishing route

Indicators of Compromise (40)

Domain

Spy.Sekur window.matchMedia Box.com Okta.com Sreact.fragment Sreact.suspense d78647fffc29caa1.css 7d25d923e0101187.css +19 more

Email Address

threatintel@eset.com

Filename

8985-aac998da933c9fa0.js 5889-e987f21560aaf28e.js 2729-aeb73907a19f63b5.js 2439-1adadaa1e6579034.js 3835-d22d4c10edf4935a.js 3178-84abbe8df47cbfa4.js 5896-a0c4463af7830410.js layout-c9b257fb005d8896.js +4 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

35 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (11)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1033 Limit Software Installation +6 more

Installation (17)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +12 more

Command & Control (14)

M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1027 Password Policies M1031 Network Intrusion Prevention +9 more

Actions on Objectives (24)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +19 more

Detection Coverage

46 strategies

6/7 stages covered

Weaponization (9)

DET0838 Detection of Virtual Private Server DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool DET0854 Detection of Virtual Private Server DET0863 Detection of Domains +4 more

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0441 Detection of Suspicious Scheduled Task C... DET0516 Behavioral Detection of Command and Scri...

Installation (7)

DET0034 Detection of Adversarial Process Discove... DET0209 Detection of Registry Query for Environm... DET0234 Credential Dumping via Sensitive Memory... DET0274 Boot or Logon Autostart Execution Detect... DET0552 Detection of Windows Service Creation or... +2 more

Command & Control (13)

DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0089 Behavioral Detection of Keylogging Activ... DET0102 Behavioral Detection of Input Capture Ac... DET0108 Detection Strategy for Data Encoding in... +8 more

Actions on Objectives (13)

DET0081 Detection of Proxy Execution via Trusted... DET0117 Detection of Masqueraded Tasks or Servic... DET0127 Behavioral Detection of Masquerading Acr... DET0145 Detection of Disabled or Modified System... DET0146 Detection of Data Destruction Across Pla... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

Carbanak

Type: Unknown Active

Anunak Carbanak Carbanak Group Carbon Spider Ukraine +10 more

Infrastructure 27 IOC(s)

50%

Domain

Spy.Sekur window.matchMedia Box.com Okta.com Sreact.fragment +22

Artifacts (13)

threatintel@eset.com 8985-aac998da933c9fa0.js 5889-e987f21560aaf28e.js 2729-aeb73907a19f63b5.js 2439-1adadaa1e6579034.js 3835-d22d4c10edf4935a.js +7

Capability

58%

46 technique(s) 63 tool(s)/malware 6 CVE(s)

Agent ORM Ammy Admin AsyncRAT Backdoor Batel Bahamut Bateleur Bateleur JScript Backdoor CHOPSTICK +55

collection

T1056 T1056.001 T1113 T1114

command and control

T1071 T1071.001 T1102 T1102.002 +4

credential access

T1003

defense impairment

T1686

Victim

70%

Targeted Sectors

financial services financial-services healthcare government hospitality energy retail defense gaming

Targeted Countries

RU US DE CN UA PL GB AE

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1583.001 T1583.003 T1583.004 T1584

Capability (Malware)

Agent ORM Ammy Admin AsyncRAT

Infrastructure

Spy.Sekur window.matchMedia Box.com

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Agent ORM Ammy Admin AsyncRAT

Infrastructure

Spy.Sekur window.matchMedia Box.com

4 Exploitation

Capability (Techniques)

T1053.005 T1059 T1059.003

Capability (Malware)

Agent ORM Ammy Admin AsyncRAT

Infrastructure

Spy.Sekur window.matchMedia Box.com

5 Installation

Capability (Techniques)

T1003 T1012 T1057 T1136 T1543

Capability (Malware)

Agent ORM Ammy Admin AsyncRAT

Infrastructure

Spy.Sekur window.matchMedia Box.com

6 Command & Control

Capability (Techniques)

T1056 T1056.001 T1113 T1114 T1071

Capability (Malware)

Agent ORM Ammy Admin AsyncRAT

Infrastructure

Spy.Sekur window.matchMedia Box.com

7 Actions on Objectives

Capability (Techniques)

T1030 T1041 T1485

Capability (Malware)

Agent ORM Ammy Admin AsyncRAT

Infrastructure

Spy.Sekur window.matchMedia Box.com