The four features of this adversary's intrusions under the Diamond Model — adversary, capability, infrastructure, victim — assembled from tracked data; pivot from any vertex to the others.
Attribution ≠ confirmation. This view assembles Void Manticore (Storm-0842)'s intrusions from tracked data and primary reporting (8 archived reports, MITRE G1055) — individual vertex links are analytic, not each independently confirmed. Treat it as an assessment, not a settled fact.
See the analysis →+139 more relationships — see the relationships browser.
The actor's techniques grouped into kill-chain phases — a partial order across phases; techniques within a phase are co-occurring, not sequenced. Export opens in CTID's Attack Flow Builder.
Phase groupings reflect ATT&CK tactic classification, not a confirmed operational timeline for Void Manticore (Storm-0842) — see the competing-hypotheses breakdown for how confident this attribution really is.
See the analysis →Curated links to related activity — not this actor's alias list. Claimed personas are marked unverified; overlap / subgroup edges describe a related but distinct cluster, never the same actor.