Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Operation Cobalt Whisper (threat actor)
Risk
81
Critical
14 techniques 43 tools/malware 23 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
27
T1053.005
Scheduled Task execution
T1059.003
Windows Command Shell execution
T1059.005
Visual Basic execution
T1204.002
Malicious File execution
CVE CVE-2015-1701
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2018-0802
CVE CVE-2019-9621
CVE CVE-2019-9670
CVE CVE-2021-26855
CVE CVE-2021-26857
CVE CVE-2021-27065
CVE CVE-2021-31207
CVE CVE-2021-34473
CVE CVE-2021-34523
CVE CVE-2022-3236
CVE CVE-2022-37969
CVE CVE-2023-22515
CVE CVE-2023-22518
CVE CVE-2023-46805
CVE CVE-2023-48788
CVE CVE-2024-21887
CVE CVE-2024-27198
CVE CVE-2024-49039
CVE CVE-2024-9680
CVE CVE-2026-50522
›
5 Installation
1
T1033
System Owner/User Discovery discovery
›
6 Command & Control
4
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1071.004
DNS command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
3
T1027
Obfuscated Files or Information stealth
T1055.002
Portable Executable Injection stealth
T1218.005
Mshta stealth
Stage risk: Critical High Medium None

Tools & Malware (43)

ANDROMEDA Akira Astaroth Beacon BianLian Buhtrap Cobalt Cobalt Strike Cobalt Strike BEACON DEADEYE DONOT Dark DarkHotel Deed RAT GitHub Global Guildma Interlock Jackal LNK files Matrix MetaStealer Naikon Nitro Payload Phishing emails Poseidon PowerShell Samurai Shamoon SideWinder Spear-phishing TeamSpy Trojan Tsunami Turla Unknown VBScript VICEROY Void Whisper gcman phishing

Indicators of Compromise (40)

Domain
cache.bak TEMP.Veles service-a8vp3r65-1319584009.cd.tencentapigw.com cache.db TEMP.Hermit Cyber.Anarchy.Squad subscription.db
Filename
ImeBroker.exe cache.vbs O365.vbs sigverif.exe cal.vbs DevicesFlow.EXE explorer.exe rundll32.exe +6 more
MD5 Hash
1d109c8bb9e6ad16cd5f6813db39c21a 5d18995193465c618844949f0ff9c786 86543a984e604430fb7685a1e707b2c4 95557088474250a9749b958c3935dee4 95f05674e4cb18a363346b488b67fd38 b2649134fbf0520222263d73b7e985d8 b28bb7cabfb12e9bc5b87692b065c83a 7728fee377137e83e9bd1c609cc166c0 +11 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +5 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (6)
M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program M1047 Audit +1 more

Detection Coverage

14 strategies
5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0441 Detection of Suspicious Scheduled Task C...

Installation (1)

DET0093 Behavioral Detection of User Discovery v...

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0400 Behavioral Detection of DNS Tunneling an... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (3)

DET0106 Behavioral Detection of PE Injection via... DET0378 Behavioral Detection of Obfuscated Files... DET0506 Detecting Mshta-based Proxy Execution vi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Operation Cobalt Whisper

Type: Unknown Active
Operation DreamJob mauvehed has traversed a long winding APT-C-35 +34 more
Infrastructure 7 IOC(s)
50%
Domain
cache.bak TEMP.Veles service-a8vp3r65-1319584009.cd.tencentapigw.com cache.db TEMP.Hermit +2
Artifacts (33)
ImeBroker.exe cache.vbs O365.vbs sigverif.exe cal.vbs DevicesFlow.EXE +27
Capability
50%
14 technique(s) 43 tool(s)/malware 23 CVE(s)
ANDROMEDA Akira Astaroth Beacon BianLian Buhtrap Cobalt Cobalt Strike +35
command and control
T1071 T1071.001 T1071.004 T1105
discovery
T1033
execution
T1053.005 T1059.003 T1059.005 T1204.002
initial access
T1190 T1566.001
Victim
70%

Targeted Sectors

government defense financial-services telecommunications non-profit energy manufacturing education pharmaceutical healthcare transportation media aerospace maritime information-technology critical-infrastructure construction chemical think-tank nuclear retail mining aviation food-agriculture utilities gaming hospitality legal-services entertainment

Targeted Countries

PK US CN IN DE GB JP RU KR SA TW IR TR FR CA UA VN AU IL KZ BR PL IT AE SG NL ES IQ BY SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

ANDROMEDA Akira Astaroth
4 Exploitation

Capability (Malware)

ANDROMEDA Akira Astaroth
5 Installation

Capability (Techniques)

T1033

Capability (Malware)

ANDROMEDA Akira Astaroth
6 Command & Control

Capability (Malware)

ANDROMEDA Akira Astaroth
Leaving Threaticon

This link opens an external site that isn't part of the platform.