Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC3524 (threat actor)

Risk

Critical

57 techniques 61 tools/malware 3 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.003

Virtual Private Server resource development

T1584

Compromise Infrastructure resource development

T1588.002

Tool resource development

T1608.003

Install Digital Certificate resource development

›

3 Delivery

No data

›

4 Exploitation

T1059.001

PowerShell execution

T1072

Software Deployment Tools execution

CVE CVE-2013-0640

CVE CVE-2023-38831

CVE CVE-2024-3400

›

5 Installation

T1003.004

LSA Secrets credential access

T1003.006

DCSync credential access

T1111

Multi-Factor Authentication Interception credential access

T1012

Query Registry discovery

T1016

System Network Configuration Discovery discovery

T1049

System Network Connections Discovery discovery

T1057

Process Discovery discovery

T1518

Software Discovery discovery

T1037.004

RC Scripts persistence

T1098.001

Additional Cloud Credentials persistence

T1505.003

Web Shell persistence

›

6 Command & Control

T1005

Data from Local System collection

T1114

Email Collection collection

T1114.002

Remote Email Collection collection

T1071

Application Layer Protocol command and control

T1090

Proxy command and control

T1090.001

Internal Proxy command and control

T1090.002

External Proxy command and control

T1090.003

Multi-hop Proxy command and control

T1090.004

Domain Fronting command and control

T1095

Non-Application Layer Protocol command and control

T1105

Ingress Tool Transfer command and control

T1568

Dynamic Resolution command and control

T1572

Protocol Tunneling command and control

T1573.002

Asymmetric Cryptography command and control

T1021

Remote Services lateral movement

T1021.004

SSH lateral movement

T1210

Exploitation of Remote Services lateral movement

T1550

Use Alternate Authentication Material lateral movement

T1570

Lateral Tool Transfer lateral movement

›

7 Actions on Objectives

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

T1027

Obfuscated Files or Information stealth

T1078.004

Cloud Accounts stealth

T1003.004 LSA Secrets

T1021.004 SSH Remote Services

T1047 Windows Management Instrumentation (WMI)

T1078 Valid Accounts – Credentials in Cloud Accounts

T1078.004 Valid Accounts - Cloud Accounts

T1079 Remote File Copy

T1090 External Proxy

T1105 Ingress Tool Transfer

T1114 Email Collection

T1125 Scripting (PowerShell) for Execution

T1193 Sideloading

T1194.001 PowerShell execution (T1059.001)

T1505.003 Web Shell

T1555 Credential Dumping and Credential Access from Local System

T1562.001 Impair Defense Evasion - Modify System Process Integrity Levels

T1572 Protocol Tunneling

T1621 Data Obfuscation

Stage risk: Critical High Medium None

Tools & Malware (61)

Akira AppleJeus Backdoors BlackByte BlackSuit COZYDUKE Carbanak Cobalt Cobalt Strike Confucius Conti CosmicDuke Custom SSH key generators Custom malware Dark DarkHotel Dropbear FRP (Fast Reverse Proxy) GOST tunneling tool GitHub Global Guard Impacket utilities Kimsuky Lambert LockBit Lynx Medusa Mimikatz MuddyWater Mythic Naikon Nexus OilRig Open-source tools PLAY Phishing campaigns Phishing emails PlugX PowerShell PowerShell scripts QUIETEXIT QuietExit (Dropbear‑based SSH backdoor) Ransomware variants ReGeorg ReGeorg web shell Remote access tools Remote desktop or VNC for secondary persistence Royal Sednit Sofacy SolarWinds Spear-phishing Trojan Turla Void Web Shell Winnti ngrok-based dynamic tunnels phishing reGeorg

Indicators of Compromise (39)

Domain

Response.BinaryWrite dynu.net mywire.org webredirect.org research.Thanks System.Net.IPEndPoint Response.AddHeader Request.InputStream.Read +23 more

Email Address

rocke@live.cn target@victimorg.com auth-agent@openssh.com

Filename

rsocx.exe report-2026.pdf cmd.exe r.exe

MD5 Hash

ba22992ce835dadcd06bff4ab7b162f9

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Exploitation (14)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +9 more

Installation (9)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +4 more

Command & Control (23)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1016 Vulnerability Scanning M1018 User Account Management M1019 Threat Intelligence Program +18 more

Actions on Objectives (11)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +6 more

Detection Coverage

40 strategies

5/7 stages covered

Weaponization (4)

DET0838 Detection of Virtual Private Server DET0840 Detection of Install Digital Certificate DET0852 Detection of Tool DET0885 Detection of Compromise Infrastructure

Exploitation (2)

DET0223 Detection of Adversary Abuse of Software... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (11)

DET0034 Detection of Adversarial Process Discove... DET0195 Behavioral Detection of System Network C... DET0209 Detection of Registry Query for Environm... DET0237 Detection Strategy for Boot or Logon Ini... DET0246 Detection Strategy for MFA Interception... +6 more

Command & Control (19)

DET0039 Detection Strategy for Dynamic Resolutio... DET0048 Detect Remote Email Collection via Abnor... DET0060 Detect Ingress Tool Transfers via Behavi... DET0075 Internal Proxy Behavior via Lateral Host... DET0118 Exploitation of Remote Services – multi-... +14 more

Actions on Objectives (4)

DET0215 Detection of Multi-Platform File Encrypt... DET0378 Behavioral Detection of Obfuscated Files... DET0495 Detection Strategy for Financial Theft DET0546 Detection of Abused or Compromised Cloud...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC3524

Type: Nation-State Active

tracked as steal Microsoft Exchange emails the 'auth code flow SVR Cozy Bear +22 more

Infrastructure 31 IOC(s)

50%

Domain

Response.BinaryWrite dynu.net mywire.org webredirect.org research.Thanks +26

Artifacts (8)

rocke@live.cn target@victimorg.com auth-agent@openssh.com rsocx.exe report-2026.pdf cmd.exe +2

Capability

50%

57 technique(s) 61 tool(s)/malware 3 CVE(s)

Akira AppleJeus Backdoors BlackByte BlackSuit COZYDUKE Carbanak Cobalt +53

T1003.004 LSA Secrets T1021.004 SSH Remote Services T1047 Windows Management Instrumentation (WMI) T1078 Valid Accounts – Credentials in Cloud Accounts +13

collection

T1005 T1114 T1114.002

command and control

T1071 T1090 T1090.001 T1090.002 +7

credential access

T1003.004 T1003.006 T1111

Victim

70%

Targeted Sectors

government financial-services defense telecommunications healthcare education manufacturing media non-profit critical-infrastructure energy think-tank pharmaceutical hospitality retail aerospace aviation information-technology transportation gaming mining chemical legal-services nuclear entertainment maritime construction oil-gas utilities food-agriculture

Targeted Countries

US CN RU GB IR UA TW VN AU IN JP PK IL SA DE AE PL BY KP KR CA SG TR MX ES RO FR NG IT LB AZ KZ NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.003 T1584 T1588.002 T1608.003

Capability (Malware)

Akira AppleJeus Backdoors

Infrastructure

Response.BinaryWrite dynu.net mywire.org

4 Exploitation

Capability (Techniques)

T1059.001 T1072

Capability (Malware)

Akira AppleJeus Backdoors

Infrastructure

Response.BinaryWrite dynu.net mywire.org

5 Installation

Capability (Techniques)

T1003.004 T1003.006 T1111 T1012 T1016

Capability (Malware)

Akira AppleJeus Backdoors

Infrastructure

Response.BinaryWrite dynu.net mywire.org

6 Command & Control

Capability (Techniques)

T1005 T1114 T1114.002 T1071 T1090

Capability (Malware)

Akira AppleJeus Backdoors

Infrastructure

Response.BinaryWrite dynu.net mywire.org

7 Actions on Objectives

Capability (Techniques)

T1486 T1657

Capability (Malware)

Akira AppleJeus Backdoors

Infrastructure

Response.BinaryWrite dynu.net mywire.org