Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Anonymous64 (threat actor)
Risk
66
High
12 techniques 42 tools/malware 0 vulnerabilities 15 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
2
T1059.001
PowerShell execution
T1204.002
Malicious File execution
›
5 Installation
2
T1133
External Remote Services persistence
T1505.003
Web Shell persistence
›
6 Command & Control
2
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
5
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
T1064
T1064
Stage risk: Critical High Medium None

Tools & Malware (42)

APT38 Akira AppleJeus Backdoors BlackByte BlackCat BlackSuit Carbanak Cobalt Cobalt Strike Confucius Conti Custom malware Dark Global Guard Hafnium Karma Kimsuky LockBit Lynx Machete Medusa MuddyWater Mythic Naikon Nexus OilRig Open-source tools PLAY Phishing campaigns Phishing emails PitTTyTiger PittyTiger Ransomware variants Remote access tools Royal SideWinder Unknown Void Winnti phishing

Indicators of Compromise (15)

Domain
theregister.com cisa.gov TEMP.Veles TEMP.Zagros Temp.Zagros TEMP.Akapav TEMP.Jumper TEMP.Periscope +6 more
Email Address
rocke@live.cn

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (7)
M1017 User Training M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program +2 more
Installation (6)
M1018 User Account Management M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network +1 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +5 more

Detection Coverage

11 strategies
5/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0294 User Execution – Malicious File via down... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (2)

DET0354 Behavior-chain detection for T1133 Exter... DET0394 Web Shell Detection via Server Behavior...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (4)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft DET0548 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Anonymous64

Type: Unknown Active
Anonymous 64 Neon Pothos Ursa Poison Vine Green Spot +18 more
Infrastructure 14 IOC(s)
50%
Domain
theregister.com cisa.gov TEMP.Veles TEMP.Zagros Temp.Zagros +9
Artifacts (1)
rocke@live.cn
Capability
50%
12 technique(s) 42 tool(s)/malware
APT38 Akira AppleJeus Backdoors BlackByte BlackCat BlackSuit Carbanak +34
T1064
command and control
T1071.001 T1105
execution
T1059.001 T1204.002
exfiltration
T1048 T1567
Victim
70%

Targeted Sectors

government financial-services defense telecommunications education healthcare manufacturing media non-profit critical-infrastructure energy hospitality retail pharmaceutical aviation aerospace information-technology transportation think-tank gaming mining chemical legal-services nuclear entertainment maritime construction oil-gas utilities food-agriculture

Targeted Countries

CN US TW RU JP IR GB UA AE VN AU IN PK IL SA DE BY SG KR KP PL CA TR MX ES RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

APT38 Akira AppleJeus
4 Exploitation

Capability (Techniques)

T1059.001 T1204.002

Capability (Malware)

APT38 Akira AppleJeus
5 Installation

Capability (Techniques)

T1133 T1505.003

Capability (Malware)

APT38 Akira AppleJeus
6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

APT38 Akira AppleJeus
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

APT38 Akira AppleJeus
Leaving Threaticon

This link opens an external site that isn't part of the platform.