Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

shinyhunters (threat actor)

Risk

High

46 techniques 0 tools/malware 0 vulnerabilities 1 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1589.001

Credentials reconnaissance

T1593.003

Code Repositories reconnaissance

T1595.002

Vulnerability Scanning reconnaissance

T1598

Phishing for Information reconnaissance

T1598.003

Spearphishing Link reconnaissance

›

2 Weaponization

T1583.001

Domains resource development

T1583.004

Server resource development

T1585.002

Email Accounts resource development

T1587.004

Exploits resource development

T1588.002

Tool resource development

T1588.007

Artificial Intelligence resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1195.001

Compromise Software Dependencies and Development Tools initial access

›

4 Exploitation

T1059.007

JavaScript execution

T1059.009

Cloud API execution

T1072

Software Deployment Tools execution

T1203

Exploitation for Client Execution execution

›

5 Installation

T1110

Brute Force credential access

T1528

Steal Application Access Token credential access

T1552.001

Credentials In Files credential access

T1016

System Network Configuration Discovery discovery

T1018

Remote System Discovery discovery

T1069.003

Cloud Groups discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1580

Cloud Infrastructure Discovery discovery

T1619

Cloud Storage Object Discovery discovery

›

6 Command & Control

T1213.003

Code Repositories collection

T1213.006

Databases collection

T1530

Data from Cloud Storage collection

T1560.002

Archive via Library collection

T1090.003

Multi-hop Proxy command and control

T1105

Ingress Tool Transfer command and control

T1219

Remote Access Tools command and control

T1573.002

Asymmetric Cryptography command and control

T1210

Exploitation of Remote Services lateral movement

T1550.001

Application Access Token lateral movement

›

7 Actions on Objectives

T1567

Exfiltration Over Web Service exfiltration

T1485

Data Destruction impact

T1491.001

Internal Defacement impact

T1657

Financial Theft impact

T1036.005

Match Legitimate Resource Name or Location stealth

T1078

Valid Accounts stealth

T1078.002

Domain Accounts stealth

T1078.004

Cloud Accounts stealth

T1684

Social Engineering stealth

Stage risk: Critical High Medium None

Tools & Malware (0)

None linked.

Indicators of Compromise (1)

Email Address

shinyc0rp@tuta.io

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (5)

M1013 Application Developer Guidance M1017 User Training M1047 Audit M1054 Software Configuration M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (10)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1033 Limit Software Installation +5 more

Exploitation (16)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +11 more

Installation (8)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1027 Password Policies +3 more

Command & Control (23)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +18 more

Actions on Objectives (15)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +10 more

Detection Coverage

46 strategies

7/7 stages covered

Reconnaissance (5)

DET0805 Detection of Code Repositories DET0813 Detection of Credentials DET0823 Detection of Phishing for Information DET0867 Detection of Vulnerability Scanning DET0878 Detection of Spearphishing Link

Weaponization (6)

DET0835 Detection of Email Accounts DET0842 Detection of Artificial Intelligence DET0852 Detection of Tool DET0871 Detection of Server DET0892 Detection of Domains +1 more

Delivery (2)

DET0009 Supply-chain tamper in dependencies/dev-... DET0080 Exploit Public-Facing Application – mult...

Exploitation (4)

DET0078 Behavioral Detection of Malicious Cloud... DET0223 Detection of Adversary Abuse of Software... DET0264 Cross-Platform Detection of JavaScript E... DET0287 Exploitation for Client Execution – cros...

Installation (10)

DET0169 Detection Strategy for Cloud Infrastruct... DET0195 Behavioral Detection of System Network C... DET0251 Behavioral Detection of Cloud Group Enum... DET0307 Detect Access to Unsecured Credential Fi... DET0370 Recursive Enumeration of Files and Direc... +5 more

Command & Control (10)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0118 Exploitation of Remote Services – multi-... DET0185 Behavioral Detection Strategy for Use Al... DET0242 Suspicious Database Access and Dump Acti... DET0263 Detecting Bulk or Anomalous Access to Pr... +5 more

Actions on Objectives (9)

DET0082 Internal Website and System Content Defa... DET0146 Detection of Data Destruction Across Pla... DET0210 Abuse of Domain Accounts DET0347 Detection Strategy for Masquerading via... DET0495 Detection Strategy for Financial Theft +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

80%

shinyhunters

Type: Criminal Sophistication: Medium First seen: 2024 Active

UNC6240 Bling Libra

Infrastructure 0 IOC(s)

50%

No infrastructure indicators linked.

Artifacts (1)

shinyc0rp@tuta.io

Capability

90%

46 technique(s)

collection

T1213.003 T1213.006 T1530 T1560.002

command and control

T1090.003 T1105 T1219 T1573.002

credential access

T1110 T1528 T1552.001

discovery

T1016 T1018 T1069.003 T1082 +3

Victim

70%

Targeted Sectors

education

Targeted Countries

United States of America Australia United Kingdom of Great Britain and Northern Ireland

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Capability → Victim

Methodology

Criminal

First Seen

2024-04-23

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.001 T1593.003 T1595.002 T1598 T1598.003

Capability (Malware)

—

Infrastructure

No infra linked

2 Weaponization

Capability (Techniques)

T1583.001 T1583.004 T1585.002 T1587.004 T1588.002

Capability (Malware)

—

Infrastructure

No infra linked

3 Delivery

Capability (Techniques)

T1190 T1195.001

Capability (Malware)

—

Infrastructure

No infra linked

4 Exploitation

Capability (Techniques)

T1059.007 T1059.009 T1072 T1203

Capability (Malware)

—

Infrastructure

No infra linked

5 Installation

Capability (Techniques)

T1110 T1528 T1552.001 T1016 T1018

Capability (Malware)

—

Infrastructure

No infra linked

6 Command & Control

Capability (Techniques)

T1213.003 T1213.006 T1530 T1560.002 T1090.003

Capability (Malware)

—

Infrastructure

No infra linked

7 Actions on Objectives

Capability (Techniques)

T1567 T1485 T1491.001 T1657

Capability (Malware)

—

Infrastructure

No infra linked