Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
FlyingYeti (threat actor)
Risk
49
Medium
0 techniques 40 tools/malware 40 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
40
CVE CVE-2023-33538
CVE CVE-2023-3883
CVE CVE-2023-38831
CVE CVE-2023-6875
CVE CVE-2024-23897
CVE CVE-2025-26385
CVE CVE-2025-46818
CVE CVE-2025-66430
CVE CVE-2026-0257
CVE CVE-2026-0625
CVE CVE-2026-12569
CVE CVE-2026-12957
CVE CVE-2026-15682
CVE CVE-2026-16812
CVE CVE-2026-22769
CVE CVE-2026-25526
CVE CVE-2026-3102
CVE CVE-2026-31431
CVE CVE-2026-34926
CVE CVE-2026-35033
CVE CVE-2026-40369
CVE CVE-2026-41089
CVE CVE-2026-42271
CVE CVE-2026-42897
CVE CVE-2026-46817
CVE CVE-2026-4782
CVE CVE-2026-48172
CVE CVE-2026-48331
CVE CVE-2026-48939
CVE CVE-2026-49176
CVE CVE-2026-50522
CVE CVE-2026-5140
CVE CVE-2026-52830
CVE CVE-2026-5386
CVE CVE-2026-56291
CVE CVE-2026-58644
CVE CVE-2026-64638
CVE CVE-2026-8631
CVE CVE-2026-8632
CVE CVE-2026-9082
›
5 Installation
No data
›
6 Command & Control
No data
›
7 Actions on Objectives
No data
Stage risk: Critical High Medium None

Tools & Malware (40)

Amadey Backdoors C2 infrastructure COOKBOX Chaos Chollima ClickFix Firefox Gemini Gemini CLI GitHub Global Infostealer Kubernetes Leverage Malicious npm packages Malware Microsoft Defender XDR Microsoft Teams MuddyWater Node.js Payload Payload Phishing campaigns Play PowerShell PowerShell Backdoor ScreenConnect SolarWinds Spear-phishing StealC Tavdig Telegram Trojan Tsunami WhatsApp Winrar Zoom npm packages phishing

Indicators of Compromise (40)

Domain
raw.githubusercontent.com ASP.NET citactica.com icw2016.coachfederation.cz hospitalvilleroy.com.br vitantgroup.com brauche-it.de okesense.oketheme.com +6 more
Filename
Node.js Next.js cmd.exe dctooux.exe procmap.exe rastls.dll kavp.exe opera.exe +4 more
MD5 Hash
a3d82455433c8ad11715865826cf18f6
SHA-256 Hash
d7e528b55b2eeb6786509664a70f641f14d0c13ceec539737eef26857355536e ced8891ea8d87005de989f25f0f94634d1fc70ebb37302cf21aa0c0b0e13350f Ee8ef58f3bf0dab066eb608cb0f167b1585e166bf4730858961c192860ceffe9 d26ac1a90f3b3f9e11491f789e55abe5b7d360df77c91a597e775f6db49902ea dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c
URL
http://citactica.com/wp-content/wp-login.phpC2 http://hospitalvilleroy.com.br/wp-includes/fonts/icons/ http://icw2016.coachfederation.cz/wp-includes/images/wp/ http://citactica.com/wp-content/wp-login.php http://vitantgroup.com/Plugins/clip64.dll http://vitantgroup.com/Plugins/cred64.dll http://icw2016.coachfederation.cz/wp-includes/images/wp/Tavdig http://hospitalvilleroy.com.br/wp-includes/fonts/icons/Tavdig

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

FlyingYeti

Type: Unknown Active
Storm-1837 Flying Yeti the threat actor SkyCloak
Infrastructure 22 IOC(s)
50%
Domain
raw.githubusercontent.com ASP.NET citactica.com icw2016.coachfederation.cz hospitalvilleroy.com.br +9
URL
http://citactica.com/wp-content/wp-login.phpC2 http://hospitalvilleroy.com.br/wp-includes/fonts/icons/ http://icw2016.coachfederation.cz/wp-includes/images/wp/ http://citactica.com/wp-content/wp-login.php http://vitantgroup.com/Plugins/clip64.dll +3
Artifacts (18)
Node.js Next.js cmd.exe dctooux.exe procmap.exe rastls.dll +12
Capability
50%
40 tool(s)/malware 40 CVE(s)
Amadey Backdoors C2 infrastructure COOKBOX Chaos Chollima ClickFix Firefox +32
Victim
70%

Targeted Sectors

financial-services government defense healthcare energy critical-infrastructure hospitality telecommunications education utilities non-profit media gaming nuclear think-tank legal-services maritime retail pharmaceutical mining

Targeted Countries

UA RU CN IR IN GB KP PL KR JP IL IT CA SG RO US TR ES MX FR TW

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges
Leaving Threaticon

This link opens an external site that isn't part of the platform.