Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

worldleaks (threat actor)

Risk

Medium

9 techniques 2 tools/malware 0 vulnerabilities 1 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1015: Software Discovery

T1021.001: Remote Services: SMB

T1041: Exfiltration Over Command and Control Channel

T1059.003: PowerShell

T1064: Scripting

T1078: Valid Accounts

T1105: Ingress Tool Transfer

T1192: Spearphishing Link

T1193: Spearphishing Attachment

Stage risk: Critical High Medium None

Tools & Malware (2)

Custom RAT backdoor PowerShell-based script implants

Indicators of Compromise (1)

Domain

cisa.gov

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

80%

worldleaks

Type: Criminal Sophistication: Medium First seen: 2022 Active

Infrastructure 1 IOC(s)

50%

Domain

cisa.gov

Capability

50%

9 technique(s) 2 tool(s)/malware

Custom RAT backdoor PowerShell-based script implants

T1015: Software Discovery T1021.001: Remote Services: SMB T1041: Exfiltration Over Command and Control Channel T1059.003: PowerShell +5

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2022-06-23

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges