Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Storm-1679 (threat actor)
Risk
100
Critical
44 techniques 58 tools/malware 9 vulnerabilities 38 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1589
Gather Victim Identity Information reconnaissance
T1595
Active Scanning reconnaissance
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1585
Establish Accounts resource development
T1587
Develop Capabilities resource development
T1588
Obtain Capabilities resource development
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
11
T1059
Command and Scripting Interpreter execution
T1651
Cloud Administration Command execution
CVE CVE-2019-0604
CVE CVE-2022-38028
CVE CVE-2023-48022
CVE CVE-2024-3400
CVE CVE-2024-39717
CVE CVE-2025-49704
CVE CVE-2025-49706
CVE CVE-2025-53770
CVE CVE-2025-53771
›
5 Installation
9
T1003
OS Credential Dumping credential access
T1110
Brute Force credential access
T1110.001
Password Guessing credential access
T1110.002
Password Cracking credential access
T1046
Network Service Discovery discovery
T1087
Account Discovery discovery
T1098
Account Manipulation persistence
T1133
External Remote Services persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
11
T1005
Data from Local System collection
T1074
Data Staged collection
T1114
Email Collection collection
T1119
Automated Collection collection
T1123
Audio Capture collection
T1213
Data from Information Repositories collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
T1570
Lateral Tool Transfer lateral movement
›
7 Actions on Objectives
15
T1484
Domain or Tenant Policy Modification defense impairment
T1685
Disable or Modify Tools defense impairment
T1686
Disable or Modify System Firewall defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1489
Service Stop impact
T1490
Inhibit System Recovery impact
T1561
Disk Wipe impact
T1657
Financial Theft impact
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1134
Access Token Manipulation stealth
T1564
Hide Artifacts stealth
T1679
Selective Exclusion stealth
Stage risk: Critical High Medium None

Tools & Malware (58)

BRICKSTORM Backdoors BlackEnergy3 CaddyWiper China Chopper China Chopper / Ckife Webshells Ckife Webshells Cobalt Conti Dark DynoWiper FrostyGoop FunnyDream GOGETTER Global Group Policy Handala Impacket Imperial Kitten Industroyer J-magic Karma KillDisk Labyrinth Chollima LazyCat LazyWiper Leverage Matryoshka Milan Neo-REGEORG Nexus OilRig Olympic Destroyer Pikabot PlugX PowerShell Quad7 ROADSWEEP Rogue SolarWinds Sunburst Telegram ToolShell Triton Tsunami Turla Unknown VPNFilter VersaMem Void Web Shell Windows Command Shell Winnti YARA ZeroCleare inter phishing reGeorge

Indicators of Compromise (38)

Domain
TEMP.Veles VirtualMachine.clone fifa.com pickers.aspx error4.aspx ClientBin.aspx libmod.de Justicehomeland.org +24 more
Filename
cmd.exe rundll32.exe comsvcs.dll cl.exe Mellona.exe GoXML.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

36 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (9)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Installation (19)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more
Command & Control (11)
M1017 User Training M1018 User Account Management M1029 Remote Data Storage M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +6 more
Actions on Objectives (21)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +16 more

Detection Coverage

44 strategies
7/7 stages covered

Reconnaissance (2)

DET0830 Detection of Active Scanning DET0841 Detection of Gather Victim Identity Info...

Weaponization (4)

DET0850 Detection of Obtain Capabilities DET0853 Detection of Develop Capabilities DET0873 Detection of Establish Accounts DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0516 Behavioral Detection of Command and Scri... DET0545 Detection Strategy for Cloud Administrat...

Installation (9)

DET0096 Account Manipulation Behavior Chain Dete... DET0105 Post-Credential Dump Password Cracking D... DET0234 Credential Dumping via Sensitive Memory... DET0274 Boot or Logon Autostart Execution Detect... DET0354 Behavior-chain detection for T1133 Exter... +4 more

Command & Control (11)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0183 Detection Strategy for Lateral Tool Tran... DET0186 Automated File and API Collection Detect... +6 more

Actions on Objectives (15)

DET0021 Behavioral Detection for Service Stop ac... DET0127 Behavioral Detection of Masquerading Acr... DET0137 Detection Strategy for Disk Wipe via Dir... DET0145 Detection of Disabled or Modified System... DET0146 Detection of Data Destruction Across Pla... +10 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Storm-1679

Type: Unknown Active
STATIC TUNDRA Sandworm Team CovertNetwork-1658 the 7777 Botnet CVE-2024-39717 +8 more
Infrastructure 32 IOC(s)
50%
Domain
TEMP.Veles VirtualMachine.clone fifa.com pickers.aspx error4.aspx +27
Artifacts (6)
cmd.exe rundll32.exe comsvcs.dll cl.exe Mellona.exe GoXML.exe
Capability
51%
44 technique(s) 58 tool(s)/malware 9 CVE(s)
BRICKSTORM Backdoors BlackEnergy3 CaddyWiper China Chopper China Chopper / Ckife Webshells Ckife Webshells Cobalt +50
collection
T1005 T1074 T1114 T1119 +3
command and control
T1071 T1071.001 T1105
credential access
T1003 T1110 T1110.001 T1110.002
defense impairment
T1484 T1685 T1686
Victim
70%

Targeted Sectors

government telecommunications media financial-services energy transportation healthcare hospitality defense critical-infrastructure aviation manufacturing information-technology education maritime think-tank non-profit construction chemical aerospace legal-services retail oil-gas nuclear

Targeted Countries

US IR CN RU UA IL MX IN CA JP KR GB FR AU PL SG VN TW DE IT KZ TR BR ES KP NG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1595

Capability (Malware)

BRICKSTORM Backdoors BlackEnergy3
2 Weaponization

Capability (Techniques)

T1583 T1585 T1587 T1588

Capability (Malware)

BRICKSTORM Backdoors BlackEnergy3
3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

BRICKSTORM Backdoors BlackEnergy3
4 Exploitation

Capability (Techniques)

T1059 T1651

Capability (Malware)

BRICKSTORM Backdoors BlackEnergy3
5 Installation

Capability (Malware)

BRICKSTORM Backdoors BlackEnergy3
6 Command & Control

Capability (Malware)

BRICKSTORM Backdoors BlackEnergy3
7 Actions on Objectives

Capability (Malware)

BRICKSTORM Backdoors BlackEnergy3
Leaving Threaticon

This link opens an external site that isn't part of the platform.