Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
LulzSec Black (threat actor)
Risk
58
High
10 techniques 41 tools/malware 1 vulnerabilities 2 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
3
T1059.003
Windows Command Shell execution
T1204
User Execution execution
CVE CVE-2026-16812
›
5 Installation
1
T1003.002
Security Account Manager credential access
›
6 Command & Control
2
T1021.001
Remote Desktop Protocol lateral movement
T1021.004
SSH lateral movement
›
7 Actions on Objectives
4
T1485
Data Destruction impact
T1499
Endpoint Denial of Service impact
T1027
Obfuscated Files or Information stealth
T1078
Valid Accounts stealth
Stage risk: Critical High Medium None

Tools & Malware (41)

9002 RAT Agent Tesla BLINDINGCAN Black Basta Brute Ratel Brute Ratel C4 Chaos Cobalt Cobalt Strike Conti Crisis Dark Dark Storm Team Diavol DieNet Enfal Epic Ghost RAT Global Guard Handala Hunter Leverage Luna Mimikatz OilRig PLAY Phishing campaigns PittyTiger Poison Ivy RATel RedLine RedLine Stealer SUNBURST Solar Telegram Telegram channels Unknown Whisper Wiper malware phishing

Indicators of Compromise (2)

Domain
demo-cloud.space
Email Address
contact@resecurity.com

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (6)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +1 more
Installation (4)
M1017 User Training M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration
Command & Control (8)
M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1032 Multi-factor Authentication +3 more
Actions on Objectives (13)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +8 more

Detection Coverage

10 strategies
5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0478 User Execution – multi-surface behavior...

Installation (1)

DET0085 Credential Dumping from SAM via Registry...

Command & Control (2)

DET0327 Multi-event Detection Strategy for RDP-B... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (4)

DET0146 Detection of Data Destruction Across Pla... DET0208 Endpoint Resource Saturation and Crash P... DET0378 Behavioral Detection of Obfuscated Files... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

LulzSec Black

Type: Unknown Active
OilRig Remix Kitten Chafer
Infrastructure 1 IOC(s)
50%
Domain
demo-cloud.space
Artifacts (1)
contact@resecurity.com
Capability
50%
10 technique(s) 41 tool(s)/malware 1 CVE(s)
9002 RAT Agent Tesla BLINDINGCAN Black Basta Brute Ratel Brute Ratel C4 Chaos Cobalt +33
credential access
T1003.002
execution
T1059.003 T1204
impact
T1485 T1499
initial access
T1566.001
Victim
70%

Targeted Sectors

defense nuclear government financial-services critical-infrastructure media transportation energy healthcare aerospace

Targeted Countries

IL IR US SA UA IQ AE RU CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

9002 RAT Agent Tesla BLINDINGCAN

Infrastructure

demo-cloud.space
4 Exploitation

Capability (Techniques)

T1059.003 T1204

Capability (Malware)

9002 RAT Agent Tesla BLINDINGCAN

Infrastructure

demo-cloud.space
5 Installation

Capability (Techniques)

T1003.002

Capability (Malware)

9002 RAT Agent Tesla BLINDINGCAN

Infrastructure

demo-cloud.space
6 Command & Control

Capability (Techniques)

T1021.001 T1021.004

Capability (Malware)

9002 RAT Agent Tesla BLINDINGCAN

Infrastructure

demo-cloud.space
7 Actions on Objectives

Capability (Techniques)

T1485 T1499

Capability (Malware)

9002 RAT Agent Tesla BLINDINGCAN

Infrastructure

demo-cloud.space
Leaving Threaticon

This link opens an external site that isn't part of the platform.