Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Storm-0835 (threat actor)
Risk
88
Critical
40 techniques 40 tools/malware 4 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
4
T1585
Establish Accounts resource development
T1585.001
Social Media Accounts resource development
T1585.002
Email Accounts resource development
T1585.003
Cloud Accounts resource development
›
3 Delivery
No data
›
4 Exploitation
8
T1053
Scheduled Task/Job execution
T1106
Native API execution
T1129
Shared Modules execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2010-2568
CVE CVE-2025-20333
CVE CVE-2025-20362
CVE CVE-2026-20182
›
5 Installation
10
T1012
Query Registry discovery
T1016
System Network Configuration Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1120
Peripheral Device Discovery discovery
T1135
Network Share Discovery discovery
T1518
Software Discovery discovery
T1505
Server Software Component persistence
T1543
Create or Modify System Process persistence
›
6 Command & Control
10
T1560
Archive Collected Data collection
T1008
Fallback Channels command and control
T1071
Application Layer Protocol command and control
T1090
Proxy command and control
T1132
Data Encoding command and control
T1573
Encrypted Channel command and control
T1021
Remote Services lateral movement
T1091
Replication Through Removable Media lateral movement
T1210
Exploitation of Remote Services lateral movement
T1570
Lateral Tool Transfer lateral movement
›
7 Actions on Objectives
12
T1112
Modify Registry defense impairment
T1553
Subvert Trust Controls defense impairment
T1685
Disable or Modify Tools defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1014
Rootkit stealth
T1027
Obfuscated Files or Information stealth
T1055
Process Injection stealth
T1070
Indicator Removal stealth
T1134
Access Token Manipulation stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1480
Execution Guardrails stealth
T0835
T0835
Stage risk: Critical High Medium None

Tools & Malware (40)

ARToken BLINDINGCAN Chollima Cobalt Conti Dark Destructive Malware Dindoor EvilProxy Fakeset FunnyDream Ghost RAT Global Handala Imperial Kitten Indrik Spider Kimsuky Labyrinth Labyrinth Chollima Lumma Stealer Malware Medusa Moonstone Sleet OilRig Phishing Kit Phishing campaigns Phishing kits Rootkit STOP Sednit Sofacy Spear-phishing Stuxnet Telegram Tsunami Unknown Velvet Chollima Void Wiper malware phishing

Indicators of Compromise (40)

Domain
Justicehomeland.org karmabelow80.org handala-hack.to handala-redwatned.to Army.mil propeller-drones.com josilos.com Elvenforest.s3.us-east-005.backblazeb2.com +6 more
Email Address
shinycorp@tutonota.com shinygroup@tuta.com shinycorp@tuta.com
Filename
explorer.exe s7otbxdx.dll xyz.dll
SHA-256 Hash
94f05495eb1b2ebe592481e01d3900615040aa02bd1807b705a50e45d7c53444 29b777e7c5470d557e34f3b7b76d2ee291c2dfe7fbaee72821b53eb50a4062c8 0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542 1d984d4b2b508b56a77c9a567fb7a50c858e672d56e8cf7677a1fca5c98c95d1 2a00705cfd3c15cf8913e9eb4e23968efd06f1feceaef9987d26c5518887d043 42a5db2a020155b2adb77c00cbe6c6ad27c2285d8c6114679d9d34137e870b3f 7467f326677a4a2c8576e71a832e297e794ea00e9b67c4fcbe78b5aec697cec4 7c30c16e7a311dc0cdb1cdfd9ea6e502f44c027328dbe7d960b9bcd85ccf5eef +10 more
URL
http://terymar.com/install/Spf.ps1 http://iuumfgrrnuhb.zhivachkapro.com/pobor

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Exploitation (11)
M1018 User Account Management M1019 Threat Intelligence Program M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +6 more
Installation (12)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management M1028 Operating System Configuration +7 more
Command & Control (18)
M1016 Vulnerability Scanning M1018 User Account Management M1019 Threat Intelligence Program M1020 SSL/TLS Inspection M1026 Privileged Account Management +13 more
Actions on Objectives (17)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +12 more

Detection Coverage

39 strategies
5/7 stages covered

Weaponization (4)

DET0835 Detection of Email Accounts DET0846 Detection of Cloud Accounts DET0851 Detection of Social Media Accounts DET0873 Detection of Establish Accounts

Exploitation (4)

DET0018 Behavior-chain, platform-aware detection... DET0094 Cross-Platform Behavioral Detection of S... DET0514 Detection Strategy for Exploitation for... DET0529 Behavioral Detection of Native API Invoc...

Installation (10)

DET0182 Behavior-chain detection for T1135 Netwo... DET0195 Behavioral Detection of System Network C... DET0209 Detection of Registry Query for Environm... DET0370 Recursive Enumeration of Files and Direc... DET0392 Multi-Platform Software Discovery Behavi... +5 more

Command & Control (10)

DET0108 Detection Strategy for Data Encoding in... DET0118 Exploitation of Remote Services – multi-... DET0183 Detection Strategy for Lateral Tool Tran... DET0269 Behavioral Detection Strategy for Remote... DET0273 Detection Strategy for Encrypted Channel... +5 more

Actions on Objectives (11)

DET0184 Behavioral Detection of Indicator Remova... DET0275 Detect Adversary Deobfuscation or Decodi... DET0280 Behavior-Based Registry Modification Det... DET0283 Behavior-chain detection for T1134 Acces... DET0348 Detection Strategy for Exfiltration Over... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Storm-0835

Type: Unknown Active
LummaC2 Stealer APT28 Pawn Storm Fancy Bear Sednit +9 more
Infrastructure 16 IOC(s)
50%
Domain
Justicehomeland.org karmabelow80.org handala-hack.to handala-redwatned.to Army.mil +9
URL
http://terymar.com/install/Spf.ps1 http://iuumfgrrnuhb.zhivachkapro.com/pobor
Artifacts (24)
shinycorp@tutonota.com shinygroup@tuta.com shinycorp@tuta.com explorer.exe s7otbxdx.dll xyz.dll +18
Capability
50%
40 technique(s) 40 tool(s)/malware 4 CVE(s)
ARToken BLINDINGCAN Chollima Cobalt Conti Dark Destructive Malware Dindoor +32
T0835
collection
T1560
command and control
T1008 T1071 T1090 T1132 +1
defense impairment
T1112 T1553 T1685
Victim
70%

Targeted Sectors

defense healthcare financial-services government manufacturing energy media non-profit education telecommunications retail aerospace think-tank critical-infrastructure

Targeted Countries

IR IL AE US KP RU UA PK TW IN IQ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

ARToken BLINDINGCAN Chollima
4 Exploitation

Capability (Techniques)

T1053 T1106 T1129 T1068

Capability (Malware)

ARToken BLINDINGCAN Chollima
5 Installation

Capability (Malware)

ARToken BLINDINGCAN Chollima
6 Command & Control

Capability (Malware)

ARToken BLINDINGCAN Chollima
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

ARToken BLINDINGCAN Chollima
Leaving Threaticon

This link opens an external site that isn't part of the platform.