Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

lyceum (threat actor)

Risk

Critical

43 techniques 57 tools/malware 3 vulnerabilities 36 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589

Gather Victim Identity Information reconnaissance

T1591

Gather Victim Org Information reconnaissance

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1585

Establish Accounts resource development

T1586

Compromise Accounts resource development

T1588

Obtain Capabilities resource development

T1608

Stage Capabilities resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1204

User Execution execution

T1204.002

Malicious File execution

T1546

Event Triggered Execution privilege escalation

CVE CVE-2023-3519

CVE CVE-2024-3400

CVE CVE-2025-22457

›

5 Installation

T1003

OS Credential Dumping credential access

T1110

Brute Force credential access

T1555

Credentials from Password Stores credential access

T1010

Application Window Discovery discovery

T1016

System Network Configuration Discovery discovery

T1018

Remote System Discovery discovery

T1033

System Owner/User Discovery discovery

T1049

System Network Connections Discovery discovery

T1057

Process Discovery discovery

T1069

Permission Groups Discovery discovery

T1082

System Information Discovery discovery

T1518

Software Discovery discovery

T1547.009

Shortcut Modification persistence

›

6 Command & Control

T1005

Data from Local System collection

T1056

Input Capture collection

T1056.001

Keylogging collection

T1074

Data Staged collection

T1001.001

Junk Data command and control

T1071

Application Layer Protocol command and control

T1071.003

Mail Protocols command and control

T1102

Web Service command and control

T1105

Ingress Tool Transfer command and control

T1572

Protocol Tunneling command and control

T1021

Remote Services lateral movement

T1021.004

SSH lateral movement

T1534

Internal Spearphishing lateral movement

›

7 Actions on Objectives

T1567

Exfiltration Over Web Service exfiltration

T1027

Obfuscated Files or Information stealth

T1036.003

Rename Legitimate Utilities stealth

Stage risk: Critical High Medium None

Tools & Malware (57)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed BADNEWS BadPatch Bandook Bazar Cobalt Cobalt Strike DNS hijacking DanBot DanDrop Dark Dig.Net DnsSystem Empire Explorer FLASHFLOOD Forfiles Global Havoc Hydraq Invoke-Obfuscation Kimsuky LODEINFO Lyceum .NET DNS Backdoor Machete Marlin MicrosoftUpdator.vbs Milan Mimikatz OilRig Phishing (generic) PoshC2 PowerShell PowerShell scripts PowerSploit ROKRAT Raccoon Raccoon Stealer Ramsay RawPOS RedCurl Shark Siamesekitten SolarWinds Spear-phishing Spirlin Trojan Turla VNC remote‑access WellMess Wevtutil Windows Command Shell dig.net ipconfig phishing

Indicators of Compromise (36)

Domain

admin.zscloud.net Dig.net dig.net news-spot.live www.rferl.org 31660048.html PictureFormat.Brightness DNS.NET +17 more

Filename

cmd.exe Appcmd.exe It11.exe esentutl.exe DnsSystem.exe

MD5 Hash

8199f14502e80581000bd5b3bda250ee 13814a190f61b36aff24d6aa1de56fe2

IPv4 Address

85.206.175.199

URL

http://news-spot.live/Reports/1/?id=1111&pid=a52 http://news-spot.live/Reports/1/?id=1111&pid=a40 http://news-spot.live/Reports/1/?id=1111&pid=a28

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (15)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +10 more

Installation (15)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +10 more

Command & Control (10)

M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +5 more

Actions on Objectives (7)

M1017 User Training M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1040 Behavior Prevention on Endpoint M1047 Audit +2 more

Detection Coverage

43 strategies

7/7 stages covered

Reconnaissance (2)

DET0841 Detection of Gather Victim Identity Info... DET0890 Detection of Gather Victim Org Informati...

Weaponization (5)

DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0873 Detection of Establish Accounts DET0876 Detection of Compromise Accounts DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (6)

DET0010 Behavioral Detection of Event Triggered... DET0094 Cross-Platform Behavioral Detection of S... DET0294 User Execution – Malicious File via down... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... +1 more

Installation (13)

DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0097 Detection of Application Window Enumerat... DET0179 Behavioral Detection of Permission Group... DET0180 Detection Strategy for T1547.009 – Short... +8 more

Command & Control (13)

DET0011 Detecting Junk Data in C2 Channels via B... DET0014 Detection of Data Staging Prior to Exfil... DET0054 Internal Spearphishing via Trusted Accou... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... +8 more

Actions on Objectives (3)

DET0005 Renamed Legitimate Utility Execution wit... DET0378 Behavioral Detection of Obfuscated Files... DET0548 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

lyceum

Type: Unknown Active

HEXANE COBALT LYCEUM UNC1530 Spirlin MYSTICDOME +21 more

Infrastructure 29 IOC(s)

50%

Domain

admin.zscloud.net Dig.net dig.net news-spot.live www.rferl.org +20

IPv4 Address

85.206.175.199

URL

http://news-spot.live/Reports/1/?id=1111&pid=a52 http://news-spot.live/Reports/1/?id=1111&pid=a40 http://news-spot.live/Reports/1/?id=1111&pid=a28

Artifacts (7)

cmd.exe Appcmd.exe It11.exe esentutl.exe DnsSystem.exe 8199f14502e80581000bd5b3bda250ee +1

Capability

52%

43 technique(s) 57 tool(s)/malware 3 CVE(s)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed BADNEWS BadPatch Bandook Bazar Cobalt +49

collection

T1005 T1056 T1056.001 T1074

command and control

T1001.001 T1071 T1071.003 T1102 +2

credential access

T1003 T1110 T1555

discovery

T1010 T1016 T1018 T1033 +5

Victim

70%

Targeted Sectors

government energy telecommunications education defense financial-services oil-gas aviation critical-infrastructure non-profit manufacturing healthcare transportation maritime hospitality gaming

Targeted Countries

Israel IR middle_east IL JP TW US SA RU UA PL IN AE KP MX BY CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1591

Capability (Malware)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed

Infrastructure

admin.zscloud.net Dig.net dig.net

2 Weaponization

Capability (Techniques)

T1583 T1585 T1586 T1588 T1608

Capability (Malware)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed

Infrastructure

admin.zscloud.net Dig.net dig.net

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed

Infrastructure

admin.zscloud.net Dig.net dig.net

4 Exploitation

Capability (Techniques)

T1053 T1059 T1059.001 T1204 T1204.002

Capability (Malware)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed

Infrastructure

admin.zscloud.net Dig.net dig.net

5 Installation

Capability (Techniques)

T1003 T1110 T1555 T1010 T1016

Capability (Malware)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed

Infrastructure

admin.zscloud.net Dig.net dig.net

6 Command & Control

Capability (Techniques)

T1005 T1056 T1056.001 T1074 T1001.001

Capability (Malware)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed

Infrastructure

admin.zscloud.net Dig.net dig.net

7 Actions on Objectives

Capability (Techniques)

T1567

Capability (Malware)

.NET DNS Backdoor (Lyceum) Amadey AppleSeed

Infrastructure

admin.zscloud.net Dig.net dig.net