Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
RipperSec (threat actor)
Risk
77
Critical
12 techniques 47 tools/malware 5 vulnerabilities 39 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
5
CVE CVE-2023-33538
CVE CVE-2024-3400
CVE CVE-2025-20333
CVE CVE-2025-20362
CVE CVE-2026-20182
›
5 Installation
No data
›
6 Command & Control
1
T1113
Screen Capture collection
›
7 Actions on Objectives
9
T1491.001
Internal Defacement impact
T1498
Network Denial of Service impact
T1027
Obfuscated Files or Information stealth
T1078
Valid Accounts stealth
T1078.001
Default Accounts stealth
T1078.002
Domain Accounts stealth
T1078.003
Local Accounts stealth
T1078.004
Cloud Accounts stealth
T0835
T0835
Stage risk: Critical High Medium None

Tools & Malware (47)

Akira BlackByte Carbanak Chimera DDoS Tools Dark Dark Storm Team Destructive Malware DieNet Dindoor Dtrack Duqu Epic Fakeset Gentlemen GitHub Global Hamsa Handala Hatef HawkEye INC Ransomware Industroyer Infostealer Kinsing Leverage Linux Rabbit Medusa MegaMedusa PLAY Phishing campaigns Qilin Rhadamanthys SUNBURST SeaDuke Silence SolarWinds Spear-phishing Spear-phishing Campaigns Spear-pitching campaigns Stealc Telegram Telegram channels Void Wiper malware megaMedusa phishing

Indicators of Compromise (39)

Domain
www.hyperfilevault2.mom Mallory.ai FalconFeeds.io www.portal.0111etisalat.com check-host.net trumpvsirancoin.xyz emiratesinvestunion.com traz.top +30 more
Filename
RedAlert.apk

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Actions on Objectives (13)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +8 more

Detection Coverage

11 strategies
3/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Command & Control (1)

DET0346 Detect Screen Capture via Commands and A...

Actions on Objectives (8)

DET0082 Internal Website and System Content Defa... DET0210 Abuse of Domain Accounts DET0378 Behavioral Detection of Obfuscated Files... DET0407 Detection of Local Account Abuse for Ini... DET0465 Detection of Default Account Abuse Acros... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

RipperSec

Type: Unknown Active
People's Cyber Army Cyber Av3ngers Storm-0784 DarkStorm MRHELL112 +9 more
Infrastructure 38 IOC(s)
50%
Domain
www.hyperfilevault2.mom Mallory.ai FalconFeeds.io www.portal.0111etisalat.com check-host.net +33
Artifacts (1)
RedAlert.apk
Capability
50%
12 technique(s) 47 tool(s)/malware 5 CVE(s)
Akira BlackByte Carbanak Chimera DDoS Tools Dark Dark Storm Team Destructive Malware +39
T0835
collection
T1113
impact
T1491.001 T1498
initial access
T1190 T1566.001
Victim
70%

Targeted Sectors

financial-services government telecommunications healthcare defense education critical-infrastructure energy manufacturing media transportation retail non-profit aviation information-technology hospitality legal-services gaming utilities aerospace construction

Targeted Countries

IL IR AE US AU IN UA GB KR TW FR SA DE RU TR CN EG JP IQ PL BR ES NG NL VN SG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Akira BlackByte Carbanak
6 Command & Control

Capability (Techniques)

T1113

Capability (Malware)

Akira BlackByte Carbanak
7 Actions on Objectives

Capability (Techniques)

T1491.001 T1498

Capability (Malware)

Akira BlackByte Carbanak
Leaving Threaticon

This link opens an external site that isn't part of the platform.