Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Star Blizzard (threat actor)
Risk
85
Critical
34 techniques 47 tools/malware 0 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
5
T1589
Gather Victim Identity Information reconnaissance
T1593
Search Open Websites/Domains reconnaissance
T1598
Phishing for Information reconnaissance
T1598.002
Spearphishing Attachment reconnaissance
T1598.003
Spearphishing Link reconnaissance
›
2 Weaponization
11
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1585
Establish Accounts resource development
T1585.001
Social Media Accounts resource development
T1585.002
Email Accounts resource development
T1586
Compromise Accounts resource development
T1586.002
Email Accounts resource development
T1588
Obtain Capabilities resource development
T1588.002
Tool resource development
T1608
Stage Capabilities resource development
T1608.001
Upload Malware resource development
›
3 Delivery
2
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
5
T1059
Command and Scripting Interpreter execution
T1059.007
JavaScript execution
T1204
User Execution execution
T1204.002
Malicious File execution
T1548
Abuse Elevation Control Mechanism privilege escalation
›
5 Installation
1
T1539
Steal Web Session Cookie credential access
›
6 Command & Control
5
T1114
Email Collection collection
T1114.002
Remote Email Collection collection
T1114.003
Email Forwarding Rule collection
T1550
Use Alternate Authentication Material lateral movement
T1550.004
Web Session Cookie lateral movement
›
7 Actions on Objectives
5
T1078
Valid Accounts stealth
T1134
Access Token Manipulation stealth
T1684
Social Engineering stealth
T1684.001
Impersonation stealth
T1676
T1676
Stage risk: Critical High Medium None

Tools & Malware (47)

APT38 Akira AndroRAT AppleJeus Backdoors BlackByte Calisto Carbanak Cobalt Confucius CrimsonRAT Custom Backdoor Custom backdoors Custom malware Custom tools Dark Evilginx Global Guard Hafnium Kimsuky Let’s Encrypt Machete Medusa Microsoft Defender XDR Microsoft Teams MuddyWater Mythic Naikon Nexus OilRig Phishing campaigns Phishing emails PowerShell Proton Remote access tools ShadowPad SideWinder SolarWinds Spear-phishing Spear-phishing Campaigns Spica Turla Void WhatsApp Winnti phishing

Indicators of Compromise (40)

Domain
introsavemsg.orgHostinger TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex file.io TEMP.hermit TEMP.Reaper +31 more
Email Address
rocke@live.cn

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (5)
M1013 Application Developer Guidance M1017 User Training M1047 Audit M1054 Software Configuration M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (16)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +11 more
Installation (6)
M1017 User Training M1021 Restrict Web-Based Content M1032 Multi-factor Authentication M1047 Audit M1051 Update Software +1 more
Command & Control (12)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +7 more
Actions on Objectives (10)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +5 more

Detection Coverage

33 strategies
7/7 stages covered

Reconnaissance (5)

DET0823 Detection of Phishing for Information DET0841 Detection of Gather Victim Identity Info... DET0856 Detection of Search Open Websites/Domain... DET0865 Detection of Spearphishing Attachment DET0878 Detection of Spearphishing Link

Weaponization (11)

DET0824 Detection of Upload Malware DET0835 Detection of Email Accounts DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0851 Detection of Social Media Accounts +6 more

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0264 Cross-Platform Detection of JavaScript E... DET0294 User Execution – Malicious File via down... DET0345 Detection Strategy for Abuse Elevation C... DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri...

Installation (1)

DET0509 Detection of Web Session Cookie Theft vi...

Command & Control (5)

DET0048 Detect Remote Email Collection via Abnor... DET0074 Detect Use of Stolen Web Session Cookies... DET0338 Behavioral Detection Strategy for Use Al... DET0476 Email Collection via Local Email Access... DET0576 Email Forwarding Rule Abuse Detection Ac...

Actions on Objectives (4)

DET0283 Behavior-chain detection for T1134 Acces... DET0286 Detection Strategy for Impersonation DET0560 Detection of Valid Account Abuse Across... DET0899 Detect Social Engineering

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Star Blizzard

Type: Unknown Active
SEABORGIUM Callisto Group TA446 COLDRIVER GOSSAMER BEAR +86 more
Infrastructure 39 IOC(s)
50%
Domain
introsavemsg.orgHostinger TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex +34
Artifacts (1)
rocke@live.cn
Capability
74%
34 technique(s) 47 tool(s)/malware
APT38 Akira AndroRAT AppleJeus Backdoors BlackByte Calisto Carbanak +39
T1676
collection
T1114 T1114.002 T1114.003
credential access
T1539
execution
T1059 T1059.007 T1204 T1204.002
Victim
70%

Targeted Sectors

government defense telecommunications financial-services education non-profit healthcare manufacturing think-tank energy media critical-infrastructure hospitality aerospace pharmaceutical aviation transportation retail chemical maritime legal-services information-technology mining gaming nuclear entertainment utilities oil-gas construction

Targeted Countries

US CN RU UA IL AE VN PK IR GB JP BY IN TW KR SA PL AU TR DE LB KZ SG IT FR MX ES CA IQ RO NG KP AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Malware)

APT38 Akira AndroRAT
2 Weaponization

Capability (Malware)

APT38 Akira AndroRAT
3 Delivery

Capability (Techniques)

T1566 T1566.001

Capability (Malware)

APT38 Akira AndroRAT
4 Exploitation

Capability (Malware)

APT38 Akira AndroRAT
5 Installation

Capability (Techniques)

T1539

Capability (Malware)

APT38 Akira AndroRAT
6 Command & Control

Capability (Malware)

APT38 Akira AndroRAT
Leaving Threaticon

This link opens an external site that isn't part of the platform.