Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

exfilsquad (threat actor)

Risk

Medium

9 techniques 28 tools/malware 0 vulnerabilities 4 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1537

Transfer Data to Cloud Account exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1486

Data Encrypted for Impact impact

T1078

Valid Accounts stealth

T1562

Stage risk: Critical High Medium None

Tools & Malware (28)

Abyss Locker Backdoor malware Chaos Clop Clop Clop Ransomware Cobalt Cobalt Strike Dark DoxxScan Global Interlock Interlock ransomware Phishing campaigns Pink PlugX Qbot Qilin Qilin Ransomware Resident Royal Royal Ransomware STOP Unknown YARA msaRAT phishing rock

Indicators of Compromise (4)

Domain

ANY.RUN redpacketsecurity.com

Email Address

support@galaxywarden.com hello@cypro.co.uk

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Command & Control (5)

M1018 User Account Management M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic M1042 Disable or Remove Feature or Program

Actions on Objectives (15)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +10 more

Detection Coverage

8 strategies

3/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Command & Control (2)

DET0444 Detection of Command and Control Over Ap... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (5)

DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over... DET0548 Detection Strategy for Exfiltration Over... DET0560 Detection of Valid Account Abuse Across... DET0573 Cross-Platform Detection of Data Transfe...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

exfilsquad

Type: Criminal Sophistication: Medium First seen: 2026 Active

tracked as Abyss Locker

Infrastructure 2 IOC(s)

50%

Domain

ANY.RUN redpacketsecurity.com

Artifacts (2)

support@galaxywarden.com hello@cypro.co.uk

Capability

50%

9 technique(s) 28 tool(s)/malware

Abyss Locker Backdoor malware Chaos Clop Clop Clop Ransomware Cobalt Cobalt Strike +20

T1562

command and control

T1071

exfiltration

T1041 T1537 T1567

impact

T1486

Victim

70%

Targeted Sectors

education government aviation financial-services manufacturing gaming information-technology media telecommunications transportation retail

Targeted Countries

GB US NG FR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2026-07-26

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Abyss Locker Backdoor malware Chaos

Infrastructure

ANY.RUN redpacketsecurity.com

6 Command & Control

Capability (Techniques)

T1071 T1021.004

Capability (Malware)

Abyss Locker Backdoor malware Chaos

Infrastructure

ANY.RUN redpacketsecurity.com

7 Actions on Objectives

Capability (Techniques)

T1041 T1537 T1567 T1486

Capability (Malware)

Abyss Locker Backdoor malware Chaos

Infrastructure

ANY.RUN redpacketsecurity.com