Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Storm-0473 (threat actor)
Risk
89
Critical
21 techniques 40 tools/malware 10 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
10
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2019-19781
CVE CVE-2020-10189
CVE CVE-2022-42475
CVE CVE-2024-3400
CVE CVE-2025-49704
CVE CVE-2025-49706
CVE CVE-2025-53770
CVE CVE-2025-53771
›
5 Installation
6
T1016
System Network Configuration Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1518.001
Security Software Discovery discovery
T1133
External Remote Services persistence
›
6 Command & Control
7
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1071.002
File Transfer Protocols command and control
T1071.003
Mail Protocols command and control
T1071.004
DNS command and control
T1071.005
Publish/Subscribe Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
7
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
T1055
Process Injection stealth
T1140
Deobfuscate/Decode Files or Information stealth
T9000
T9000
Stage risk: Critical High Medium None

Tools & Malware (40)

Akira Avenger Backdoors BlackByte BlackCat BlackEnergy Chollima Cobalt Cobalt Strike CrimsonRAT Custom malware Dark Global Kimsuky Latrodectus LockBit Malware Medusa MuddyWater Nexus OilRig Payload Phishing campaigns Play PlugX PowerShell REvil ROKRAT Royal SideWinder Snake Sofacy Spear-phishing Systeminfo Tomiris TrickBot Trojan Turla Winnti phishing

Indicators of Compromise (40)

Domain
ur253.duckdns.org
Filename
MpSvcS.dll oci.dll DUser.dll duser.dll credwiz.exe hubstck.exe auddrv.exe lustsorelfar.exe +14 more
MD5 Hash
2ddea77933e345319f335529d35b6c1a
SHA-256 Hash
7c4ef30bd1b5cb690d2603e33264768e3b42752660c79979a5db80816dfb2ad2 dbbf8108fd14478ae05d3a3a6aabc242bff6af6eb1e93cbead4f5a23c3587ced 7c7fad6b9ecb1e770693a6c62e0cc4183f602b892823f4a451799376be915912 e2d033b324450e1cb7575fedfc784e66488e342631f059988a9a2fd6e006d381 59d7ec6ec97c6b958e00a3352d38dd13876fecdb2bb13a8541ab93248edde317 aba8b59281faa8c1c43a4ca7af075edd3e3516d3cef058a1f43b093177b8f83c C039ec6622393f9324cacbf8cfaba3b7a41fe6929812ce3bd5d79b0fdedc884a e298b83891b192b8a2782e638e7f5601acf13bab2f619215ac68a0b61230a273 +1 more
IPv4 Address
146.70.158.90 143.198.73.108 45.14.194.253 94.177.198.94 162.213.195.129 46.249.58.201 95.111.229.253

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Installation (5)
M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (11)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +6 more

Detection Coverage

20 strategies
4/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (6)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0195 Behavioral Detection of System Network C... DET0354 Behavior-chain detection for T1133 Exter... DET0370 Recursive Enumeration of Files and Direc... +1 more

Command & Control (7)

DET0002 Behavioral Detection of Publish/Subscrib... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0135 Detection of Mail Protocol-Based C2 Acti... DET0400 Behavioral Detection of DNS Tunneling an... +2 more

Actions on Objectives (6)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0275 Detect Adversary Deobfuscation or Decodi... DET0495 Detection Strategy for Financial Theft DET0508 Behavioral Detection of Process Injectio... +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Storm-0473

Type: Unknown Active
UNC2849 other aliases several other aliases Chafer Tomiris +36 more
Infrastructure 8 IOC(s)
50%
Domain
ur253.duckdns.org
IPv4 Address
146.70.158.90 143.198.73.108 45.14.194.253 94.177.198.94 162.213.195.129 +2
Artifacts (32)
MpSvcS.dll oci.dll DUser.dll duser.dll credwiz.exe hubstck.exe +26
Capability
50%
21 technique(s) 40 tool(s)/malware 10 CVE(s)
Akira Avenger Backdoors BlackByte BlackCat BlackEnergy Chollima Cobalt +32
T9000
command and control
T1071 T1071.001 T1071.002 T1071.003 +3
discovery
T1016 T1057 T1082 T1083 +1
exfiltration
T1048 T1567
Victim
70%

Targeted Sectors

government financial-services defense healthcare telecommunications critical-infrastructure education manufacturing media non-profit energy maritime retail hospitality aerospace think-tank transportation gaming utilities information-technology aviation legal-services mining oil-gas nuclear entertainment food-agriculture construction

Targeted Countries

RU UA IN CN IR US PK KP KR TW AE AU SA BY BR GB MX VN CA AZ DE TR ES NL PL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Akira Avenger Backdoors
5 Installation

Capability (Malware)

Akira Avenger Backdoors
6 Command & Control

Capability (Malware)

Akira Avenger Backdoors
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

Akira Avenger Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.