Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
HikkI-Chan (threat actor)
Risk
64
High
8 techniques 46 tools/malware 1 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
4
T1059.003
Windows Command Shell execution
T1204
User Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2015-1701
›
5 Installation
1
T1087
Account Discovery discovery
›
6 Command & Control
1
T1095
Non-Application Layer Protocol command and control
›
7 Actions on Objectives
2
T1041
Exfiltration Over C2 Channel exfiltration
T1070
Indicator Removal stealth
Stage risk: Critical High Medium None

Tools & Malware (46)

Botnets Buhtrap Cobalt Cobalt Strike (possible link) Crisis DEADEYE Dark DarkHotel DarkSide ELMER Explosive Ghost RAT Global Guard HellCat Ransomware Hellsing Hidden Cobra IRONHALO Interception Jackal Matrix Mirage MuddyWater Naikon Nexus Nitro OilRig PlugX Poseidon Predator Rootkit Samurai Shamoon Shark Spear-phishing Specter Stuxnet TeamSpy Trojan Tsunami Turla Unknown VICEROY Void gcman phishing

Indicators of Compromise (39)

Domain
TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie TEMP.Noble +31 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (10)
M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation +5 more
Installation (2)
M1018 User Account Management M1028 Operating System Configuration
Command & Control (4)
M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit
Actions on Objectives (5)
M1022 Restrict File and Directory Permissions M1029 Remote Data Storage M1031 Network Intrusion Prevention M1041 Encrypt Sensitive Information M1057 Data Loss Prevention

Detection Coverage

8 strategies
5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0478 User Execution – multi-surface behavior... DET0514 Detection Strategy for Exploitation for...

Installation (1)

DET0587 Enumeration of User or Account Informati...

Command & Control (1)

DET0457 Detection of Non-Application Layer Proto...

Actions on Objectives (2)

DET0184 Behavioral Detection of Indicator Remova... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

HikkI-Chan

Type: Unknown Active
Anonchan a person-to-person attacks cpyy APT3 Gothic Panda +13 more
Infrastructure 39 IOC(s)
50%
Domain
TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo +34
Capability
50%
8 technique(s) 46 tool(s)/malware 1 CVE(s)
Botnets Buhtrap Cobalt Cobalt Strike (possible link) Crisis DEADEYE Dark DarkHotel +38
command and control
T1095
discovery
T1087
execution
T1059.003 T1204
exfiltration
T1041
Victim
70%

Targeted Sectors

government defense financial-services non-profit telecommunications healthcare manufacturing energy aerospace media maritime education food-agriculture information-technology think-tank nuclear chemical mining pharmaceutical transportation construction hospitality legal-services entertainment

Targeted Countries

US CN GB IN JP DE IR KR IL RU SA FR TW TR CA AU KZ PK VN UA PL AE SY SG NL BR ES IQ BY AZ IT MX RO NG LB KP EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Botnets Buhtrap Cobalt
4 Exploitation

Capability (Techniques)

T1059.003 T1204 T1068

Capability (Malware)

Botnets Buhtrap Cobalt
5 Installation

Capability (Techniques)

T1087

Capability (Malware)

Botnets Buhtrap Cobalt
6 Command & Control

Capability (Techniques)

T1095

Capability (Malware)

Botnets Buhtrap Cobalt
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Botnets Buhtrap Cobalt
Leaving Threaticon

This link opens an external site that isn't part of the platform.