Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

vanirgroup (threat actor)

Risk

Medium

2 techniques 24 tools/malware 0 vulnerabilities 6 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1486

Data Encrypted for Impact impact

Stage risk: Critical High Medium None

Tools & Malware (24)

Akira Akira ransomware Alphv Atmosphere Dark Globe Havoc Infostealer Infostealer family Kimsuky Knight LockBit MarkiRAT Matrix Mole Nexus RansomHub Retro Telegram Telegram channels Unknown Vanir Ransomware YARA rock

Indicators of Compromise (6)

Domain

Logo.dev 6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion Strobes.coSign vanirgroup.yar ransomlook.io P.IVA

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

4 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Actions on Objectives (4)

M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup M1057 Data Loss Prevention

Detection Coverage

2 strategies

1/7 stages covered

Actions on Objectives (2)

DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

vanirgroup

Type: Criminal Sophistication: Medium First seen: 2024 Active

vanir group

Infrastructure 6 IOC(s)

50%

Domain

Logo.dev 6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion Strobes.coSign vanirgroup.yar ransomlook.io +1

Capability

50%

2 technique(s) 24 tool(s)/malware

Akira Akira ransomware Alphv Atmosphere Dark Globe Havoc Infostealer +16

exfiltration

T1041

impact

T1486

Victim

70%

Targeted Sectors

information-technology defense education financial-services manufacturing healthcare energy

Targeted Countries

DE IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2024-07-10

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

Akira Akira ransomware Alphv

Infrastructure

Logo.dev 6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion Strobes.coSign