Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Threat Actor 888 (threat actor)
Risk
55
High
1 techniques 40 tools/malware 40 vulnerabilities 30 IOCs 2/7 stages covered Deepest: Exploitation
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
40
CVE CVE-2023-33538
CVE CVE-2023-6875
CVE CVE-2024-23897
CVE CVE-2025-26385
CVE CVE-2025-46818
CVE CVE-2025-66430
CVE CVE-2026-0257
CVE CVE-2026-0625
CVE CVE-2026-12569
CVE CVE-2026-12957
CVE CVE-2026-15682
CVE CVE-2026-16812
CVE CVE-2026-22769
CVE CVE-2026-25526
CVE CVE-2026-3102
CVE CVE-2026-31431
CVE CVE-2026-34926
CVE CVE-2026-35033
CVE CVE-2026-40369
CVE CVE-2026-41089
CVE CVE-2026-42271
CVE CVE-2026-42897
CVE CVE-2026-46300
CVE CVE-2026-46817
CVE CVE-2026-4782
CVE CVE-2026-4798
CVE CVE-2026-48172
CVE CVE-2026-48331
CVE CVE-2026-48939
CVE CVE-2026-49176
CVE CVE-2026-50522
CVE CVE-2026-5140
CVE CVE-2026-52830
CVE CVE-2026-5386
CVE CVE-2026-56291
CVE CVE-2026-58644
CVE CVE-2026-64638
CVE CVE-2026-8631
CVE CVE-2026-8632
CVE CVE-2026-9082
›
5 Installation
No data
›
6 Command & Control
No data
›
7 Actions on Objectives
No data
Stage risk: Critical High Medium None

Tools & Malware (40)

Backdoors ClickFix Cobalt Dark DarkHotel Gemini CLI Gentlemen GitHub Global Infostealer Jackal Kubernetes Leverage Lynx Malware Matrix Microsoft Teams MuddyWater Naikon Nexus Node.js PLAY Payload Payload Phishing campaigns Poseidon PowerShell Remcos Remcos RAT SolarWinds Spear-phishing Stealc TeamSpy Telegram Trojan Tsunami Void WhatsApp npm packages phishing

Indicators of Compromise (30)

Domain
Checkout.com haveibeenpwned.com insightsoftware.com Services.This Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao +18 more
Filename
Node.js Next.js Fondue.exe protobuf.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

8 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Detection Coverage

1 strategies
1/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Threat Actor 888

Type: Unknown Active
SkyCloak cpyy APT3 Gothic Panda UPS Team +21 more
Infrastructure 26 IOC(s)
50%
Domain
Checkout.com haveibeenpwned.com insightsoftware.com Services.This Cyber.Anarchy.Squad +21
Artifacts (4)
Node.js Next.js Fondue.exe protobuf.js
Capability
50%
1 technique(s) 40 tool(s)/malware 40 CVE(s)
Backdoors ClickFix Cobalt Dark DarkHotel Gemini CLI Gentlemen GitHub +32
initial access
T1190
Victim
70%

Targeted Sectors

government financial-services defense non-profit telecommunications energy healthcare education media aerospace critical-infrastructure hospitality retail maritime pharmaceutical information-technology manufacturing think-tank mining nuclear legal-services gaming aviation chemical utilities entertainment

Targeted Countries

CN US GB IR IN JP KR DE RU UA CA TW SA FR TR PL IL AU KZ PK RO SG VN IT ES BR MX AE NL IQ BY SY KP EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Backdoors ClickFix Cobalt
Leaving Threaticon

This link opens an external site that isn't part of the platform.