Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
IRLeaks (threat actor)
Risk
61
High
9 techniques 52 tools/malware 1 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
2
T1106
Native API execution
CVE CVE-2023-33538
›
5 Installation
1
T1133
External Remote Services persistence
›
6 Command & Control
No data
›
7 Actions on Objectives
5
T1041
Exfiltration Over C2 Channel exfiltration
T1485
Data Destruction impact
T1499
Endpoint Denial of Service impact
T1078
Valid Accounts stealth
T1605
T1605
Stage risk: Critical High Medium None

Tools & Malware (52)

9002 RAT ALFA TEaM Shell Agent Tesla Agent Tesla BLACKCOFFEE BLINDINGCAN Backdoors CL-STA-1128 Cyber Av3ngers DROPSHOT Dark Dark Storm Team Derusbi DieNet Enfal Formbook Ghost RAT Ghost RAT Global Handala KeyBoy Leverage MRHELL112 MacDownloader Malicious Android replica of Israeli Home Front Command RedAlert APK Mango Matrix Mimikatz MuddyWater Payload Phishing campaigns Phoenix PittyTiger Poison Ivy RobinHood SHAPESHIFT STOP SUNBURST SentinelOne SolarWinds StealC Stealc TEARDROP TURNEDUP Tarnished Scorpius (Inc. Ransomware) Telegram TurnedUp WhatsApp bugsleep malicious HTA files phishing rock

Indicators of Compromise (40)

Domain
2pd.f22.mytemp.website demo-cloud.space www.portal.0111etisalat.com trumpvsirancoin.xyz emiratesinvestunion.com traz.top emirates-post.racunari-bl.com alpha.filehost36.sbs +31 more
Filename
RedAlert.apk

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (2)
M1038 Execution Prevention M1040 Behavior Prevention on Endpoint
Installation (5)
M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program
Actions on Objectives (12)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +7 more

Detection Coverage

8 strategies
4/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0529 Behavioral Detection of Native API Invoc...

Installation (1)

DET0354 Behavior-chain detection for T1133 Exter...

Actions on Objectives (4)

DET0146 Detection of Data Destruction Across Pla... DET0208 Endpoint Resource Saturation and Crash P... DET0348 Detection Strategy for Exfiltration Over... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

IRLeaks

Type: Unknown Active
DarkStorm MRHELL112 KeyBoy APT35 Charming Kitten +12 more
Infrastructure 39 IOC(s)
50%
Domain
2pd.f22.mytemp.website demo-cloud.space www.portal.0111etisalat.com trumpvsirancoin.xyz emiratesinvestunion.com +34
Artifacts (1)
RedAlert.apk
Capability
53%
9 technique(s) 52 tool(s)/malware 1 CVE(s)
9002 RAT ALFA TEaM Shell Agent Tesla Agent Tesla BLACKCOFFEE BLINDINGCAN Backdoors CL-STA-1128 +44
T1605
execution
T1106
exfiltration
T1041
impact
T1485 T1499
Victim
70%

Targeted Sectors

financial-services government defense retail energy healthcare telecommunications critical-infrastructure media manufacturing non-profit aviation education hospitality gaming

Targeted Countries

IR AE IL CN GB US SA DE IT

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

9002 RAT ALFA TEaM Shell Agent Tesla
4 Exploitation

Capability (Techniques)

T1106

Capability (Malware)

9002 RAT ALFA TEaM Shell Agent Tesla
5 Installation

Capability (Techniques)

T1133

Capability (Malware)

9002 RAT ALFA TEaM Shell Agent Tesla
7 Actions on Objectives

Capability (Techniques)

T1041 T1485 T1499

Capability (Malware)

9002 RAT ALFA TEaM Shell Agent Tesla
Leaving Threaticon

This link opens an external site that isn't part of the platform.