Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

BITWISE SPIDER (threat actor)

Risk

Critical

25 techniques 89 tools/malware 1 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2026-20929

›

5 Installation

T1003.001

LSASS Memory credential access

T1110

Brute Force credential access

T1528

Steal Application Access Token credential access

T1555.003

Credentials from Web Browsers credential access

T1543.003

Windows Service persistence

›

6 Command & Control

T1113

Screen Capture collection

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1021

Remote Services lateral movement

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1486

Data Encrypted for Impact impact

T1078

Valid Accounts stealth

T1218.004

InstallUtil stealth

T1048.004

T1074.3

T1075

T1404

T1487

Stage risk: Critical High Medium None

Tools & Malware (89)

3AM Akira Alphv AsyncRAT BRAIN Backdoors BianLian Bitwise Spider BlackCat BokBot Brute Ratel Buhti COATHOOK Casabaneiro (Mekotio) Chronus Team Clop Cobalt Cobalt Strike Conti CrackMapExec Custom backdoors Custom malware DanaBot Dark DarkSide Defray777 Download Link Servers (DLS) Dridex EmpireProject Fenix botnet Ferocious Global Grandoreiro Guacamaya Guard HTRAN Hermit Hive Hook IcedID Indrik Spider Jackal KV-Botnet Kronos Latrodectus Leverage LockBit LockBit 3.0 LockBit RED LockBit ransomware Lotus Loader Maze Mexicnon Mimikatz Mispadu Stealer NJrat Nanocore RAT Nexus PLAY Phishing campaigns PowerShell PowerShell Empire PrivateLoader PsExec QUICKBALL Qilin QuickPulse REvil RansomHub Royal Ryuk SOGU STOP SentinelOne Social engineering tactics SparrowDoor Spear-phishing Spear-phishing Campaigns StealBIT Syrphid TWOCHAINS Trojan Unknown Wicked Zero-day exploits adrxx credential stealers such as WCE gsecdump phishing

Indicators of Compromise (39)

Domain

button-Ct-RMRBT.css TEMP.Zagros Math.random window.history.replaceState JSON.parse sessionStorage.getItem window.scrollTo console.error +21 more

Filename

entry.client-xi9AqQZ0.js mXM-Yz36.js chunk-LFPYN7LY-CpxNu6ao.js index-D3Fer45w.js asset.constants-DrNIgL2k.js button-Czd0yO2F.js dynamic-body-DD3adkJC.js root-Ca9sT03B.js +2 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (9)

M1019 Threat Intelligence Program M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing +4 more

Installation (14)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1025 Privileged Process Integrity M1026 Privileged Account Management +9 more

Command & Control (8)

M1018 User Account Management M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network +3 more

Actions on Objectives (14)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +9 more

Detection Coverage

20 strategies

5/7 stages covered

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0514 Detection Strategy for Exploitation for...

Installation (5)

DET0037 Detect Suspicious Access to Browser Cred... DET0363 Detection of Credential Dumping from LSA... DET0463 Brute Force Authentication Failures with... DET0515 Detection Strategy for T1528 - Steal App... DET0552 Detection of Windows Service Creation or...

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0269 Behavioral Detection Strategy for Remote... DET0346 Detect Screen Capture via Commands and A...

Actions on Objectives (4)

DET0138 Detection of Malicious Code Execution vi... DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

BITWISE SPIDER

Type: Unknown Active

other aliases LockBit several other aliases UNC3944 first identified in 2014 +109 more

Infrastructure 29 IOC(s)

50%

Domain

button-Ct-RMRBT.css TEMP.Zagros Math.random window.history.replaceState JSON.parse +24

Artifacts (10)

entry.client-xi9AqQZ0.js mXM-Yz36.js chunk-LFPYN7LY-CpxNu6ao.js index-D3Fer45w.js asset.constants-DrNIgL2k.js button-Czd0yO2F.js +4

Capability

52%

25 technique(s) 89 tool(s)/malware 1 CVE(s)

3AM Akira Alphv AsyncRAT BRAIN Backdoors BianLian Bitwise Spider +81

T1048.004 T1074.3 T1075 T1404 +1

collection

T1113

command and control

T1071.001 T1105

credential access

T1003.001 T1110 T1528 T1555.003

Victim

70%

Targeted Sectors

financial-services government healthcare defense telecommunications critical-infrastructure manufacturing education media energy aviation transportation non-profit legal-services aerospace hospitality utilities think-tank maritime gaming retail information-technology aerospace & defense legal

Targeted Countries

MX RU US CN IR BR IN KP KR TR UA VN PK CA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566 T1566.001 T1566.002

Capability (Malware)

3AM Akira Alphv

Infrastructure

button-Ct-RMRBT.css TEMP.Zagros Math.random

4 Exploitation

Capability (Techniques)

T1059.001 T1059.003 T1068

Capability (Malware)

3AM Akira Alphv

Infrastructure

button-Ct-RMRBT.css TEMP.Zagros Math.random

5 Installation

Capability (Techniques)

T1003.001 T1110 T1528 T1555.003 T1543.003

Capability (Malware)

3AM Akira Alphv

Infrastructure

button-Ct-RMRBT.css TEMP.Zagros Math.random

6 Command & Control

Capability (Techniques)

T1113 T1071.001 T1105 T1021

Capability (Malware)

3AM Akira Alphv

Infrastructure

button-Ct-RMRBT.css TEMP.Zagros Math.random

7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

3AM Akira Alphv

Infrastructure

button-Ct-RMRBT.css TEMP.Zagros Math.random