Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Iron Group (threat actor)

Risk

High

14 techniques 55 tools/malware 4 vulnerabilities 39 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2014-6352

CVE CVE-2016-3088

CVE CVE-2022-42475

CVE CVE-2024-3400

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1197

BITS Jobs stealth

T1036 – Masquerading

T1047 – Windows Management Instrumentation (WMI)

T1055 – Process Injection

T1059.001 – PowerShell

T1064 – Scripting

T1071.001 – Web Services (HTTP/HTTPS)

T1071.003 – DNS

T1082 – System Information Discovery

T1086

T1105 – Remote File Copy

T1197 – BITS Jobs

T5000

T9000

Stage risk: Critical High Medium None

Tools & Malware (55)

AcidRain Akira BLINDINGCAN Backdoor malware Backdoors BeaverTail Black Basta BlackByte BlackByte Ransomware BlackCat Cobalt Cobalt Strike Conti Crimson Custom Backdoor Dark Desert Scorpion Exaramel FiveHands GitHub HiddenFace IcedID IronErn440 IronHusky ItaDuke Kimsuky LockBit Medusa Mimikatz MiniDuke Mobile malware MuddyWater MySQL NOKKI Naikon NotPetya OilRig PLAY Payload Payload PlugX PowerShell PowerShell backdoor Rootkit Shamoon SolarWinds SpyC23 TrickBot Trojan Turla Unknown Web Shell Wmiexec Xbash phishing

Indicators of Compromise (39)

Domain

demo-cloud.space DEADEYE.APPEND LITTLELAMB.WOOLTEA Trojan-SMS.AndroidOS.Agent.ao Trojan-SMS.AndroidOS.FakeInst Trojan-SMS.AndroidOS.OpFake Trojan.Mebromi Trojan-SMS.AndroidOS.Smaps +15 more

Email Address

backupsql@pm.me

Filename

Node.js net.exe cipher.exe csc.exe certutil.exe arp.exe cmd.exe enterprise-attack-v16.1-software.xlsx +6 more

URL

http://e3sas6tzvehwgpak.tk/XbashY

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

3 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Actions on Objectives (3)

M1018 User Account Management M1028 Operating System Configuration M1037 Filter Network Traffic

Detection Coverage

1 strategies

1/7 stages covered

Actions on Objectives (1)

DET0098 Detect abuse of Windows BITS Jobs for do...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Iron Group

Type: Unknown Active

Iron Cyber Group Rocke tracked as H63D non-C282Y homozygous +10 more

Infrastructure 24 IOC(s)

50%

Domain

demo-cloud.space DEADEYE.APPEND LITTLELAMB.WOOLTEA Trojan-SMS.AndroidOS.Agent.ao Trojan-SMS.AndroidOS.FakeInst +18

URL

http://e3sas6tzvehwgpak.tk/XbashY

Artifacts (15)

backupsql@pm.me Node.js net.exe cipher.exe csc.exe certutil.exe +9

Capability

50%

14 technique(s) 55 tool(s)/malware 4 CVE(s)

AcidRain Akira BLINDINGCAN Backdoor malware Backdoors BeaverTail Black Basta BlackByte +47

T1036 – Masquerading T1047 – Windows Management Instrumentation (WMI) T1055 – Process Injection T1059.001 – PowerShell +9

stealth

T1197

Victim

70%

Targeted Sectors

financial-services government defense telecommunications manufacturing education healthcare energy transportation critical-infrastructure media information-technology retail aerospace mining pharmaceutical aviation maritime chemical legal-services nuclear hospitality gaming

Targeted Countries

US RU KR CN UA BR GB IN PL AU MX DE ES CA JP IL TR SY TW IT SA IR FR VN SG PK AE NL AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges