Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Static Tundra (threat actor)

Risk

Critical

27 techniques 46 tools/malware 3 vulnerabilities 12 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1595

Active Scanning reconnaissance

T1595.001

Scanning IP Blocks reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1200

Hardware Additions initial access

›

4 Exploitation

T1203

Exploitation for Client Execution execution

T1569

System Services execution

CVE CVE-2018-0171

CVE CVE-2023-27532

CVE CVE-2025-50165

›

5 Installation

T1003

OS Credential Dumping credential access

T1552.004

Private Keys credential access

T1016

System Network Configuration Discovery discovery

T1046

Network Service Discovery discovery

T1098

Account Manipulation persistence

T1136

Create Account persistence

T1547

Boot or Logon Autostart Execution persistence

›

6 Command & Control

T1602.001

SNMP (MIB Dump) collection

T1602.002

Network Device Configuration Dump collection

T1071

Application Layer Protocol command and control

T1090

Proxy command and control

›

7 Actions on Objectives

T1601

Modify System Image defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1048

Exfiltration Over Alternative Protocol exfiltration

T1027

Obfuscated Files or Information stealth

T1078

Valid Accounts stealth

T1542.003

Bootkit stealth

T1542.004

ROMMONkit stealth

T1073

T1562

Stage risk: Critical High Medium None

Tools & Malware (46)

BPFDoor BlackByte BlackByte Ransomware C2 infrastructure CALENDAR CVE‑2018‑0171 Smart Install Exploit Cursor Custom tools Dark Destructive Malware DynoWiper DynoWiper wiper malware Evilginx Expand Exploit code GitHub Global Hunter Interception Kraken LONGLEASH LazyWiper LazyWiper wiper malware Leverage LockBit LockBit ransomware Longleash OpenSSL HollowByte Qilin Qilin Ransomware Rogue SNMP Toolkit STOP SYNful Knock SYNful Knock firmware implant Shark Silence Solar Starland RAT TFTP Server for Configuration Exfiltration Talos TFTP/FTP Detection Script Telegram TuxBot v3 Evolution WhatsApp inter phishing

Indicators of Compromise (12)

Domain

output.txt CVE-2018-0171.Disable software.Select

Filename

msimg32.dll

IPv4 Address

185.141.24.28 185.82.200.181 3.6.1.4 1.9.9.96 185.82.202.34 4.1.9.9 185.141.24.222 1.3.6.1

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

32 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Delivery (9)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1034 Limit Hardware Installation M1035 Limit Access to Resource Over Network +4 more

Exploitation (7)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint M1048 Application Isolation and Sandboxing +2 more

Installation (16)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +11 more

Command & Control (7)

M1020 SSL/TLS Inspection M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information +2 more

Actions on Objectives (19)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +14 more

Detection Coverage

25 strategies

6/7 stages covered

Reconnaissance (3)

DET0817 Detection of Scanning IP Blocks DET0830 Detection of Active Scanning DET0867 Detection of Vulnerability Scanning

Delivery (2)

DET0069 Detect unauthorized or suspicious Hardwa... DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0279 Detection Strategy for System Services a... DET0287 Exploitation for Client Execution – cros...

Installation (7)

DET0096 Account Manipulation Behavior Chain Dete... DET0195 Behavioral Detection of System Network C... DET0234 Credential Dumping via Sensitive Memory... DET0274 Boot or Logon Autostart Execution Detect... DET0376 Behavioral Detection Strategy for Networ... +2 more

Command & Control (4)

DET0233 Detection Strategy for Network Device Co... DET0444 Detection of Command and Control Over Ap... DET0445 Detection of Proxy Infrastructure Setup... DET0453 Detection Strategy for SNMP (MIB Dump) o...

Actions on Objectives (7)

DET0131 Behavioral Detection Strategy for Exfilt... DET0150 Detection Strategy for File Creation or... DET0170 Detection Strategy for Modify System Ima... DET0175 Detection Strategy for T1542.004 Pre-OS... DET0348 Detection Strategy for Exfiltration Over... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

50%

Static Tundra

Type: apt Active

Energetic Bear BERSERK BEAR techniques victimology FSB Center 16 +20 more

Infrastructure 11 IOC(s)

50%

Domain

output.txt CVE-2018-0171.Disable software.Select

IPv4 Address

185.141.24.28 185.82.200.181 3.6.1.4 1.9.9.96 185.82.202.34 +3

Artifacts (1)

msimg32.dll

Capability

50%

27 technique(s) 46 tool(s)/malware 3 CVE(s)

BPFDoor BlackByte BlackByte Ransomware C2 infrastructure CALENDAR CVE‑2018‑0171 Smart Install Exploit Cursor Custom tools +38

T1073 T1562

collection

T1602.001 T1602.002

command and control

T1071 T1090

credential access

T1003 T1552.004

Victim

70%

Targeted Sectors

energy manufacturing defense telecommunications critical-infrastructure government education financial-services healthcare nuclear maritime construction

Targeted Countries

Poland RU UA US AE GB CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Apt

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595 T1595.001 T1595.002

Capability (Malware)

BPFDoor BlackByte BlackByte Ransomware

Infrastructure

output.txt CVE-2018-0171.Disable software.Select

3 Delivery

Capability (Techniques)

T1190 T1200

Capability (Malware)

BPFDoor BlackByte BlackByte Ransomware

Infrastructure

output.txt CVE-2018-0171.Disable software.Select

4 Exploitation

Capability (Techniques)

T1203 T1569

Capability (Malware)

BPFDoor BlackByte BlackByte Ransomware

Infrastructure

output.txt CVE-2018-0171.Disable software.Select

5 Installation

Capability (Techniques)

T1003 T1552.004 T1016 T1046 T1098

Capability (Malware)

BPFDoor BlackByte BlackByte Ransomware

Infrastructure

output.txt CVE-2018-0171.Disable software.Select

6 Command & Control

Capability (Techniques)

T1602.001 T1602.002 T1071 T1090

Capability (Malware)

BPFDoor BlackByte BlackByte Ransomware

Infrastructure

output.txt CVE-2018-0171.Disable software.Select

7 Actions on Objectives

Capability (Techniques)

T1041 T1048

Capability (Malware)

BPFDoor BlackByte BlackByte Ransomware

Infrastructure

output.txt CVE-2018-0171.Disable software.Select