Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Calypso (threat actor)

Risk

High

6 techniques 60 tools/malware 9 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Installation

1 Reconnaissance

T1595

Active Scanning reconnaissance

›

2 Weaponization

T1587.004

Exploits resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1203

Exploitation for Client Execution execution

CVE CVE-2021-26855

CVE CVE-2021-26857

CVE CVE-2021-26858

CVE CVE-2021-27065

CVE CVE-2022-41040

CVE CVE-2022-41082

CVE CVE-2025-40947

CVE CVE-2025-40948

CVE CVE-2026-0257

›

5 Installation

T1505.003

Web Shell persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (60)

Agent.UFX BYEBY Backdoors Bisonal Byebe CHINACHOPPER CMSTAR Calypso RAT China Chopper Cobalt Cobalt Strike Crisis Custom Backdoor DCSync DLTMiner Dark Delphi Backdoor DoublePulsar ETERNALBLUE Emdivi FlyingDutchman GitHub Global Hafnium JFMBackdoor Korplug MSI installer Malicious files Mikroceen RAT Mimikatz Mirage NBTscan Owlproxy Payload Payload Pink PlugX PlugX RAT PowerShell Revive ShadowPad Showboat Slave Sugar SysUpdate Telerik.Windows.Data.Validation.dll Termite Triton Trojan Tsunami Unknown Web Shell Web Shells Webshells WhiteBird Win64.SHADOWPAD.AS.enc Winnti Winnti malware mscoree.dll phishing

Indicators of Compromise (40)

Domain

RedirSuiteServerProxy.aspx lab.symantecsafe.org back.rooter.tk Korplug.ED mm.portomnail.com ns.rtechs.org mscoree.dll.dat soft.mssysinfo.xyz +13 more

Filename

SRVCON.OCX applaunch.exe calcx.exe rapi.dll Telerik.Windows.Data.Validation.dll mscoree.dll

SHA-1 Hash

4F0EA31A363CFE0D2BBB4A0B4C5D558A87D8683E 02886F9DAA13F7D9855855048C54F1D6B1231B0A EB8D39CE08B32A07B7D847F6C29F4471CD8264F2 30DD3076EC9ABB13C15053234C436406B88FB2B9

SHA-256 Hash

0122734490fe4dfb287d34394667d81ab46e0d05d4569d06a41f0f3c3a36448c 253f474aa0147fdcf88beaae40f3a23bdadfc98b8dd36ae2d81c387ced2db4f1

IPv4 Address

77.83.159.15 161.129.64.124 86.105.18.116 45.76.84.36 91.220.203.86 172.105.18.72 89.34.111.11

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (3)

M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Installation (2)

M1018 User Account Management M1042 Disable or Remove Feature or Program

Detection Coverage

6 strategies

5/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (1)

DET0894 Detection of Exploits

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0287 Exploitation for Client Execution – cros...

Installation (1)

DET0394 Web Shell Detection via Server Behavior...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Calypso

Type: Unknown Active

BRONZE MEDLEY Red Lamassu Links to Skyipot Pitty Tiger Comment Crew +25 more

Infrastructure 28 IOC(s)

50%

Domain

RedirSuiteServerProxy.aspx lab.symantecsafe.org back.rooter.tk Korplug.ED mm.portomnail.com +16

IPv4 Address

77.83.159.15 161.129.64.124 86.105.18.116 45.76.84.36 91.220.203.86 +2

Artifacts (12)

SRVCON.OCX applaunch.exe calcx.exe rapi.dll Telerik.Windows.Data.Validation.dll mscoree.dll +6

Capability

51%

6 technique(s) 60 tool(s)/malware 9 CVE(s)

Agent.UFX BYEBY Backdoors Bisonal Byebe CHINACHOPPER CMSTAR Calypso RAT +52

execution

T1203

initial access

T1190 T1566.001

persistence

T1505.003

reconnaissance

T1595

Victim

70%

Targeted Sectors

government telecommunications financial-services defense critical-infrastructure information-technology construction manufacturing mining aviation healthcare education aerospace technology media gaming

Targeted Countries

US CN PK IN RU DE JP IT KZ AU GB UA TR BR KR SG

Diamond Model Meta-Features

Phase

Installation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

Agent.UFX BYEBY Backdoors

Infrastructure

RedirSuiteServerProxy.aspx lab.symantecsafe.org back.rooter.tk

2 Weaponization

Capability (Techniques)

T1587.004

Capability (Malware)

Agent.UFX BYEBY Backdoors

Infrastructure

RedirSuiteServerProxy.aspx lab.symantecsafe.org back.rooter.tk

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Agent.UFX BYEBY Backdoors

Infrastructure

RedirSuiteServerProxy.aspx lab.symantecsafe.org back.rooter.tk

4 Exploitation

Capability (Techniques)

T1203

Capability (Malware)

Agent.UFX BYEBY Backdoors

Infrastructure

RedirSuiteServerProxy.aspx lab.symantecsafe.org back.rooter.tk

5 Installation

Capability (Techniques)

T1505.003

Capability (Malware)

Agent.UFX BYEBY Backdoors

Infrastructure

RedirSuiteServerProxy.aspx lab.symantecsafe.org back.rooter.tk