Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UTG-Q-010 (threat actor)
Risk
88
Critical
36 techniques 75 tools/malware 4 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
5
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1195
Supply Chain Compromise initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
13
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1203
Exploitation for Client Execution execution
T1204
User Execution execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1546
Event Triggered Execution privilege escalation
CVE CVE-2015-1701
CVE CVE-2017-11882
CVE CVE-2025-40778
CVE CVE-2026-50522
›
5 Installation
6
T1003
OS Credential Dumping credential access
T1040
Network Sniffing credential access
T1111
Multi-Factor Authentication Interception credential access
T1016
System Network Configuration Discovery discovery
T1082
System Information Discovery discovery
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
6
T1056.001
Keylogging collection
T1113
Screen Capture collection
T1115
Clipboard Data collection
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
T1021
Remote Services lateral movement
›
7 Actions on Objectives
10
T1041
Exfiltration Over C2 Channel exfiltration
T1486
Data Encrypted for Impact impact
T1499
Endpoint Denial of Service impact
T1499.001
OS Exhaustion Flood impact
T1027
Obfuscated Files or Information stealth
T1078
Valid Accounts stealth
T1134
Access Token Manipulation stealth
T1497
Virtualization/Sandbox Evasion stealth
T1079.001
T1079.001
T1116
T1116
Stage risk: Critical High Medium None

Tools & Malware (75)

Anchor Atlas RAT BKDR RARSTONE BTMOB Banana RAT Buhtrap Carbon China Chopper WebShell Cobalt Cobalt Strike Cobalt Strike (potential future use) Cryptocurrency Lure DEADEYE Dark DarkHotel Docker ELMER Global Havoc Hellsing Hidden Cobra IRONHALO IceFog Jackal Kubernetes Leverage Lockbit Lynx MacDownloader Matrix Mimikatz Mirage MirageFox variant Mythic Naikon NetTraveler Nexus Nitro OilRig PLAY Phishing emails Poison Ivy Poseidon Predator Pupy Pupy RAT ROTbot RoyalAPT framework Rundll32.exe (malicious use) STONE DRILL Sakula Samurai Shamoon Shark Spear-phishing SpySolr TURNEDUP TeamSpy Terraform TidePool Trojan Tsunami Turla UAT-7290 Unknown VICEROY Void Warlock Weaponized VPN installer WerFault.exe (process for sideloading) XSLCmd backdoor faultrep.dll (DLL payload) free5GC gcman phishing

Indicators of Compromise (39)

Domain
19.Wilson TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +23 more
Email Address
a.mozo@upm.es amit.kbatra@alumnos.upm.es sm.gomez@upm.es antonio.pastorperales@telefonica.com mario.sanz@upm.es joseignacio.moreno@upm.es
Filename
updateng.exe rundll32.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (18)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +13 more
Exploitation (17)
M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management +12 more
Installation (12)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management +7 more
Command & Control (8)
M1018 User Account Management M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network +3 more
Actions on Objectives (15)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +10 more

Detection Coverage

34 strategies
5/7 stages covered

Delivery (5)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (9)

DET0010 Behavioral Detection of Event Triggered... DET0066 User Execution – Malicious Link (click →... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... +4 more

Installation (6)

DET0195 Behavioral Detection of System Network C... DET0234 Credential Dumping via Sensitive Memory... DET0246 Detection Strategy for MFA Interception... DET0314 Detection Strategy for Network Sniffing... DET0365 Detect Registry and Startup Folder Persi... +1 more

Command & Control (6)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0269 Behavioral Detection Strategy for Remote... DET0341 Clipboard Data Access with Anomalous Con... +1 more

Actions on Objectives (8)

DET0046 Detection Strategy for T1497 Virtualizat... DET0208 Endpoint Resource Saturation and Crash P... DET0215 Detection of Multi-Platform File Encrypt... DET0283 Behavior-chain detection for T1134 Acces... DET0348 Detection Strategy for Exfiltration Over... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UTG-Q-010

Type: Unknown Active
the Newscaster Team SHADOW-WATER-063 cpyy APT3 Gothic Panda +15 more
Infrastructure 31 IOC(s)
50%
Domain
19.Wilson TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +26
Artifacts (8)
a.mozo@upm.es amit.kbatra@alumnos.upm.es sm.gomez@upm.es antonio.pastorperales@telefonica.com mario.sanz@upm.es joseignacio.moreno@upm.es +2
Capability
50%
36 technique(s) 75 tool(s)/malware 4 CVE(s)
Anchor Atlas RAT BKDR RARSTONE BTMOB Banana RAT Buhtrap Carbon China Chopper WebShell +67
T1079.001 T1116
collection
T1056.001 T1113 T1115
command and control
T1071.001 T1105
credential access
T1003 T1040 T1111
Victim
70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy aerospace media education information-technology maritime manufacturing healthcare think-tank mining pharmaceutical critical-infrastructure chemical hospitality legal-services nuclear entertainment food-agriculture

Targeted Countries

US CN GB IN JP DE KR IR RU SA FR TW CA IL TR VN AU KZ PK UA PL NL BY AE SG IT BR ES IQ SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Malware)

Anchor Atlas RAT BKDR RARSTONE
4 Exploitation

Capability (Malware)

Anchor Atlas RAT BKDR RARSTONE
5 Installation

Capability (Malware)

Anchor Atlas RAT BKDR RARSTONE
6 Command & Control

Capability (Malware)

Anchor Atlas RAT BKDR RARSTONE
7 Actions on Objectives

Capability (Malware)

Anchor Atlas RAT BKDR RARSTONE
Leaving Threaticon

This link opens an external site that isn't part of the platform.