Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

section9 (threat actor)

Risk

Critical

10 techniques 56 tools/malware 40 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2012-1823

CVE CVE-2013-5948

CVE CVE-2014-8361

CVE CVE-2015-2051

CVE CVE-2016-6277

CVE CVE-2017-0781

CVE CVE-2017-0785

CVE CVE-2017-1000250

CVE CVE-2017-1000251

CVE CVE-2017-10271

CVE CVE-2017-14135

CVE CVE-2017-17215

CVE CVE-2017-18368

CVE CVE-2017-5638

CVE CVE-2017-8221

CVE CVE-2017-8222

CVE CVE-2017-8223

CVE CVE-2017-8224

CVE CVE-2017-8225

CVE CVE-2018-10561

CVE CVE-2018-14847

CVE CVE-2018-20062

CVE CVE-2018-7445

CVE CVE-2018-7600

CVE CVE-2019-10758

CVE CVE-2019-19356

CVE CVE-2019-2725

CVE CVE-2020-10173

CVE CVE-2020-10987

CVE CVE-2020-15893

CVE CVE-2020-24217

CVE CVE-2020-25506

CVE CVE-2020-26919

CVE CVE-2020-5902

CVE CVE-2020-7115

CVE CVE-2020-7209

CVE CVE-2021-22502

CVE CVE-2021-27561

CVE CVE-2021-27562

CVE CVE-2022-0543

›

5 Installation

T1110

Brute Force credential access

T1046

Network Service Discovery discovery

›

6 Command & Control

T1071

Application Layer Protocol command and control

›

7 Actions on Objectives

T1499

Endpoint Denial of Service impact

T1078

Valid Accounts stealth

T1107

T1523

T1562

Stage risk: Critical High Medium None

Tools & Malware (56)

APEP AirDropBot Ares Bashlite BillGates Blueborne Botnets BrickerBot Cr1ptT0r Darlloz EchoBot Echobot Emotet FritzFrog Gamut Gitpaste-12 Global Hades Hajime Hide and Seek Hydra JenX Joker Kaiji Masuta Miori Mirai Moose Mozi Muhstik Necurs Omni Owari PLAY Payload Payload Persirai Psybot Qbot Satori Setag Shishiga Silex Skeeyah Sora SoraLOADER SpyBot TheMoon Trojan Tsunami VPNFilter Wicked ZHtrap Zollard cpuminer malware distribution

Indicators of Compromise (39)

Domain

FalconFeeds.io securityweek.com j.procs j.iot stix-v2.1-os.html prosecutions.That Security.National j.jpdc +22 more

Email Address

pvictor@unb.ca elizabeth.cannon@usdoj.gov ahabibil@yorku.ca rlu1@unb.ca tsasi@unb.ca pulei.xiong@nrc-cnrc.gc.ca shahrear.iqbal@nrc-cnrc.gc.ca NSDCES.ExportVSD@usdoj.gov

IPv4 Address

183.83.0.0

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (5)

M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Installation (7)

M1018 User Account Management M1027 Password Policies M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +2 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (9)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +4 more

Detection Coverage

7 strategies

5/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0514 Detection Strategy for Exploitation for...

Installation (2)

DET0376 Behavioral Detection Strategy for Networ... DET0463 Brute Force Authentication Failures with...

Command & Control (1)

DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (2)

DET0208 Endpoint Resource Saturation and Crash P... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

section9

Type: Criminal Sophistication: Medium First seen: 2026 Active

tracked as casual such as a nickname Trojan Horse Trojan Virus +24 more

Infrastructure 31 IOC(s)

50%

Domain

FalconFeeds.io securityweek.com j.procs j.iot stix-v2.1-os.html +25

IPv4 Address

183.83.0.0

Artifacts (8)

pvictor@unb.ca elizabeth.cannon@usdoj.gov ahabibil@yorku.ca rlu1@unb.ca tsasi@unb.ca pulei.xiong@nrc-cnrc.gc.ca +2

Capability

50%

10 technique(s) 56 tool(s)/malware 40 CVE(s)

APEP AirDropBot Ares Bashlite BillGates Blueborne Botnets BrickerBot +48

T1107 T1523 T1562

command and control

T1071

credential access

T1110

discovery

T1046

Victim

70%

Targeted Sectors

financial-services government defense mining education non-profit manufacturing media healthcare critical-infrastructure information-technology gaming food-agriculture

Targeted Countries

US VN CN SY IQ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2026-07-26

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

APEP AirDropBot Ares

Infrastructure

FalconFeeds.io securityweek.com j.procs

4 Exploitation

Capability (Techniques)

T1068

Capability (Malware)

APEP AirDropBot Ares

Infrastructure

FalconFeeds.io securityweek.com j.procs

5 Installation

Capability (Techniques)

T1110 T1046

Capability (Malware)

APEP AirDropBot Ares

Infrastructure

FalconFeeds.io securityweek.com j.procs

6 Command & Control

Capability (Techniques)

T1071

Capability (Malware)

APEP AirDropBot Ares

Infrastructure

FalconFeeds.io securityweek.com j.procs

7 Actions on Objectives

Capability (Techniques)

T1499

Capability (Malware)

APEP AirDropBot Ares

Infrastructure

FalconFeeds.io securityweek.com j.procs