Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Water Makara (threat actor)
Risk
69
High
9 techniques 60 tools/malware 40 vulnerabilities 38 IOCs 3/7 stages covered Deepest: Command & Control
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
3
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
45
T1059.003
Windows Command Shell execution
T1059.007
JavaScript execution
T1106
Native API execution
T1204.002
Malicious File execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2009-0556
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2018-0802
CVE CVE-2019-9621
CVE CVE-2019-9670
CVE CVE-2021-26855
CVE CVE-2021-26857
CVE CVE-2021-27065
CVE CVE-2021-31207
CVE CVE-2021-34473
CVE CVE-2021-34523
CVE CVE-2022-3236
CVE CVE-2022-37969
CVE CVE-2023-22515
CVE CVE-2023-22518
CVE CVE-2023-46805
CVE CVE-2023-48788
CVE CVE-2024-21887
CVE CVE-2024-27198
CVE CVE-2024-49039
CVE CVE-2024-9680
CVE CVE-2025-14847
CVE CVE-2025-22224
CVE CVE-2025-22225
CVE CVE-2025-22226
CVE CVE-2025-37164
CVE CVE-2025-53690
CVE CVE-2025-55182
CVE CVE-2025-64155
CVE CVE-2025-8088
CVE CVE-2025-8110
CVE CVE-2026-0625
CVE CVE-2026-20316
CVE CVE-2026-20805
CVE CVE-2026-21509
CVE CVE-2026-23550
CVE CVE-2026-24061
CVE CVE-2026-40369
CVE CVE-2026-66066
›
5 Installation
No data
›
6 Command & Control
1
T1071.001
Web Protocols command and control
›
7 Actions on Objectives
No data
Stage risk: Critical High Medium None

Tools & Malware (60)

AHK Bot ANDROMEDA Aisuru Akira AnyDesk Astaroth Backdoors CSharp-Streamer-RAT ClickFix Cobalt Cobalt Strike Conti CrowDoor DEMODEX Dark Deed RAT Docker Firefox GHOSTSPIDER Gentlemen GitHub Global Infostealer Interlock Interlock ransomware Kimwolf Lumma Stealer MASOL RAT Malwarebytes MetaStealer Microsoft Teams Phishing Kit Phishing campaigns Phishing emails PlugX PowerShell PowerShower backdoor Qilin Remote Utilities Resident backdoor Rhadamanthys RomCom RAT SNAPPYBEE STOP ScreenShotter SparrowDoor Spear-phishing Spear-phishing emails Telegram Trojan Turla Unknown VBCloud implant VBShower backdoor ValleyRAT WasabiSeed WhatsApp Whisper npm packages phishing

Indicators of Compromise (38)

Domain
blog.talosintelligence.com unit42.paloaltonetworks.com securelist.com www.fortinet.com www.bleepingcomputer.com DataBreaches.Net cyberpress.org www.malwarebytes.com +19 more
Filename
Next.js VsGraphicsDesktopEngine.exe rundll32.exe svchost.exe Node.js rc.exe explorer.exe mshta.exe +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (9)
M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Detection Coverage

9 strategies
3/7 stages covered

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0294 User Execution – Malicious File via down... DET0514 Detection Strategy for Exploitation for... DET0529 Behavioral Detection of Native API Invoc...

Command & Control (1)

DET0027 Detection of Web Protocol-Based C2 Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Water Makara

Type: Unknown Active
PINEAPPLE APT29 Cozy Bear Storm-2945 ATTACK RedCurl +30 more
Infrastructure 27 IOC(s)
50%
Domain
blog.talosintelligence.com unit42.paloaltonetworks.com securelist.com www.fortinet.com www.bleepingcomputer.com +22
Artifacts (11)
Next.js VsGraphicsDesktopEngine.exe rundll32.exe svchost.exe Node.js rc.exe +5
Capability
50%
9 technique(s) 60 tool(s)/malware 40 CVE(s)
AHK Bot ANDROMEDA Aisuru Akira AnyDesk Astaroth Backdoors CSharp-Streamer-RAT +52
command and control
T1071.001
execution
T1059.003 T1059.007 T1106 T1204.002
initial access
T1189 T1190 T1566.001
privilege escalation
T1068
Victim
70%

Targeted Sectors

financial-services government defense healthcare telecommunications education energy manufacturing critical-infrastructure media pharmaceutical transportation construction retail non-profit hospitality aviation maritime information-technology food-agriculture chemical mining legal-services utilities nuclear think-tank aerospace gaming

Targeted Countries

US CN RU IR BR UA IN PK CA DE TR TW PL KP JP GB KR IT AE FR ES SG IL VN AU SA RO NG AZ

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1190 T1566.001

Capability (Malware)

AHK Bot ANDROMEDA Aisuru
4 Exploitation

Capability (Malware)

AHK Bot ANDROMEDA Aisuru
6 Command & Control

Capability (Techniques)

T1071.001

Capability (Malware)

AHK Bot ANDROMEDA Aisuru
Leaving Threaticon

This link opens an external site that isn't part of the platform.