# Analysis of Cyber-Intelligence Frameworks for AI Data Processing
## 4 Materials and Methods
### Application of the Diamond Model  
The incident data are structured according to the Diamond Model following the four vertices. To simplify the analysis and to avoid bias, confidence values have been omitted. * Victim: The public entity analysed (RASK) is a victim of the Public Administration sector in Spain, with a geographical location distributed throughout the Spanish territory. Its popularity is high, and its political positioning is neutral. The economic capacity is low, as it does not have its own resources. The maturity of the organisation is low, as demonstrated by subsequent audits. The organisation is highly critical, as it is an essential entity for the exercise of the functions of the Spanish state. The types of systems affected are desktops and servers, including the five domain controllers. The information is not classified, but it is personal information subject to legislation. The organisation is not known to have exposed CVEs. The victim belongs to the Spanish Administration Sector, which is seriously lacking in cybersecurity, as shown in successive national reports on the state of security of ICT systems published by the national CSIRT [38]. * Capability: The malware used was at least Cobalt Strike, Ryuk, Bazar Loader, and SystemBC. There is no evidence of vulnerability exploitation because it was not necessary, as the attacker had administrator credentials. The malware used does not reflect great sophistication as they are evolutions of known malware widely used by cybercriminals in their attacks. It requires the intervention of the adversary, but no victims for the attack. Although the initial method of obtaining credentials is unknown, there is no evidence of the application of social engineering techniques. It is not part of any campaign to exploit or distribute malware through phishing or other types of attacks. * Infrastructure: Once the information had been analysed from a technical point of view, the following IP addresses and domains that made up the main C2s were provided: --.26.29[. ]242 (Media Land LLC- Saint Petersburg 09-09-2020) culunk[. ]com resolutions (registration 22/02/2021) --.141.84[. ]190 (Media Land LLC- Saint Petersburg 14-11-2019) resolutions by smadst[. ]com (registration 22/02/2021) --.26.29[. ]245 (Media Land LLC- Saint Petersburg 09-09-2020) eochea[. ]com resolutions (registration 03/02/2021) --.141.87[. ]76 (Media Land LLC- Saint Petersburg 25-12-2020) dorkedit[. ]com resolutions (registration 03/03/2021) The domains culunk[. ]com, smadst[. ]com, eochea[. ]com, and dorkedit[.] were registered in close temporal proximity and have registration, hosting, and SSL certificate consistencies with previously identified UNC1878 domains [39]. The sets of UNC1878 domains were registered through _NameCheap_ or _OpenProvider_, used their own name servers, are hosted on dedicated servers at the Russian Federation Media Land LLC IP IPS, and use multiple SSL certificate chains. * Adversary: Probable attribution by identifying TTPs, as well as by matching IP ranges and domains with Cobalt Strike servers, can presumably be associated with UNC1878, an Eastern European cybercriminal group with connections to Ukraine and Russia, whose purpose is economic. UNC groups can evolve, eventually merging with other groups and potentially drifting into actors with recognised threat names such as \"Advanced Persistent Threats\" (APTs) or \"Financially-Motivated Hacking Groups\" (FINs) [40]. Some expert research has attributed the name \"Group One\" to the UNCT1878 actor, stating that its targets are \"indiscriminate\" and its infections are \"opportunistic\" and assigning it the following characteristics [41]: 1. Infection vector: phishing emails, usually containing links. 2. Speed of execution: the time between initial infection and encryption has recently been reduced from around 2-5 days to between 3 and 6 hours. 3. Consistent use of self-signed Cobalt Strike samples. 4.