Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

barracuda (threat actor)

Risk

High

10 techniques 46 tools/malware 1 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

CVE CVE-2023-2868

›

5 Installation

T1133

External Remote Services persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

T1048

Exfiltration Over Alternative Protocol exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

T1497

Virtualization/Sandbox Evasion stealth

T1497.001

System Checks stealth

T1497.002

User Activity Based Checks stealth

T1497.003

Time Based Checks stealth

Stage risk: Critical High Medium None

Tools & Malware (46)

Attor Backdoors BadPatch Black Basta BlackByte BlackByte Ransomware BlackSuit Bumblebee China Chopper / Ckife Webshells Cobalt Conti Dark DarkGate DarkHotel GCat Global GreyEngergy Mini as their 1st-stage implant Kimsuky Latrodectus LazyCat Leverage LockBit Lynx Mythic Nexus OilRig OlympicDestroyer Payload Payload Phishing campaigns Phishing emails PowerShell QakBot ROKRAT Rootkit Royal Royal Ransomware SALTWATER SEASPY SKIPJACK STOP Snip3 SynAck WHIRLPOOL phishing reGeorge

Indicators of Compromise (40)

Domain

macOS.OSAMiner Trojan.Karagany temp.sh string.find os.execute string.match cron.hourly core.sh +7 more

Email Address

sales@barracuda.com

Filename

snapshot.tar tar.gz tmp.tar.gz

MD5 Hash

35cf6faf442d325961935f660e2ab5a0 be5b6b52780d35f1392f45d96beb868c 4ca4f582418b2cc0626700511a6315c0 cd2813f0260d63ad5adf0446253c2172 87847445f9524671022d70f2a812728f 177add288b289d43236d2dba33e65956 e4e86c273a2b67a605f5d4686783e0cc 0d67f50a0bf7a3a017784146ac41ada0 +2 more

SHA-1 Hash

51f7900806f0783f09d45d5017a89322afeb3fc3 0ea7adb0b54d8bada0a8dc41ef4a9b255691d1ba

SHA-256 Hash

6d1d7fe5be6f1db2d7aa2af2b53ef40c2ac06954d983bb40590944c4d00b6e57 6b60c1c833979494caff32bf02391793ac85f533516367f12a1cea857bbacba7

IPv4 Address

101.229.146.218 216.238.112.82 9.2.0.006 5.1.3.001 107.148.149.156 107.148.219.55 137.175.51.147

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Installation (5)

M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +5 more

Detection Coverage

10 strategies

3/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (1)

DET0354 Behavior-chain detection for T1133 Exter...

Actions on Objectives (8)

DET0046 Detection Strategy for T1497 Virtualizat... DET0131 Behavioral Detection Strategy for Exfilt... DET0141 Detect Time-Based Evasion via Sleep, Tim... DET0168 Virtualization/Sandbox Evasion via Syste... DET0215 Detection of Multi-Platform File Encrypt... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

barracuda

Type: Criminal Sophistication: Medium First seen: 2026 Active

UNC4841 tracked as the Seapike APT44 sectors +22 more

Infrastructure 22 IOC(s)

50%

Domain

macOS.OSAMiner Trojan.Karagany temp.sh string.find os.execute +10

IPv4 Address

101.229.146.218 216.238.112.82 9.2.0.006 5.1.3.001 107.148.149.156 +2

Artifacts (18)

sales@barracuda.com snapshot.tar tar.gz tmp.tar.gz 35cf6faf442d325961935f660e2ab5a0 be5b6b52780d35f1392f45d96beb868c +12

Capability

53%

10 technique(s) 46 tool(s)/malware 1 CVE(s)

Attor Backdoors BadPatch Black Basta BlackByte BlackByte Ransomware BlackSuit Bumblebee +38

exfiltration

T1048 T1567

impact

T1486 T1657

initial access

T1190

persistence

T1133

Victim

70%

Targeted Sectors

government financial-services education healthcare telecommunications defense critical-infrastructure manufacturing media retail non-profit information-technology hospitality mining energy aerospace maritime nuclear entertainment gaming food-agriculture construction transportation

Targeted Countries

CN GB TW IN UA RU US DE KP IR AZ PK BY PL CA AU europe

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

Resources

government

First Seen

2026-08-05

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Attor Backdoors BadPatch

Infrastructure

macOS.OSAMiner Trojan.Karagany temp.sh

5 Installation

Capability (Techniques)

T1133

Capability (Malware)

Attor Backdoors BadPatch

Infrastructure

macOS.OSAMiner Trojan.Karagany temp.sh

7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

Attor Backdoors BadPatch

Infrastructure

macOS.OSAMiner Trojan.Karagany temp.sh