Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
SYLHET GANG-SG (threat actor)
Risk
73
High
11 techniques 47 tools/malware 4 vulnerabilities 39 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
5
T1059.003
Windows Command Shell execution
CVE CVE-2023-33538
CVE CVE-2025-20333
CVE CVE-2025-20362
CVE CVE-2026-20182
›
5 Installation
No data
›
6 Command & Control
2
T1105
Ingress Tool Transfer command and control
T1021.004
SSH lateral movement
›
7 Actions on Objectives
6
T1485
Data Destruction impact
T1498.002
Reflection Amplification impact
T1078
Valid Accounts stealth
T0835
T0835
T1064
T1064
T1086
T1086
Stage risk: Critical High Medium None

Tools & Malware (47)

Backdoors Botnets Crimson Crimson RAT Custom Backdoor Custom multi‑stage loaders Dark Darkcomp Destructive Malware Dindoor Dindoor (Deno‑based backdoor) Epic Fakeset Fakeset (Python backdoor) Ghost RAT GitHub Global Globe Hamsa (Linux wiper) Handala Hatef Hatef (Windows wiper) Infostealer Infostealer malware Leverage MuddyWater Mythic Octopus PLAY Payload Phishing campaigns PowerShell scripts used for lateral movement Rhadamanthys Rhadamanthys (infostealer) SUNBURST Spear-phishing Spear-phishing Campaigns Stagecomp Stealc Stuxnet Telegram Tycoon Unknown Void Wiper malware XRed phishing

Indicators of Compromise (39)

Domain
Gitempire.s3.us-east-005.backblazeb2.com kuwaitarmy.gov.kw www.portal.0111etisalat.com trumpvsirancoin.xyz emiratesinvestunion.com traz.top emirates-post.racunari-bl.com alpha.filehost36.sbs +15 more
Filename
Attack-Report-on-Aviation-Industry.pdf
SHA-256 Hash
2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5 077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de 15061036c702ad92b56b35e42cf5dc334597e7311e98d2fdd3815a69ac3b1d84 29b777e7c5470d557e34f3b7b76d2ee291c2dfe7fbaee72821b53eb50a4062c8 0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542 1d984d4b2b508b56a77c9a567fb7a50c858e672d56e8cf7677a1fca5c98c95d1 2a00705cfd3c15cf8913e9eb4e23968efd06f1feceaef9987d26c5518887d043 42a5db2a020155b2adb77c00cbe6c6ad27c2285d8c6114679d9d34137e870b3f +5 more
URL
http://terymar.com/install/Spf.ps1 http://iuumfgrrnuhb.zhivachkapro.com/pobor

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (1)
M1038 Execution Prevention
Command & Control (5)
M1018 User Account Management M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic M1042 Disable or Remove Feature or Program
Actions on Objectives (10)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +5 more

Detection Coverage

8 strategies
4/7 stages covered

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Command & Control (2)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (3)

DET0146 Detection of Data Destruction Across Pla... DET0408 Detection Strategy for Reflection Amplif... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

SYLHET GANG-SG

Type: Unknown Active
Transparent Tribe DarkStorm MRHELL112 Earth Karkaddan Mythic Leopard +9 more
Infrastructure 25 IOC(s)
50%
Domain
Gitempire.s3.us-east-005.backblazeb2.com kuwaitarmy.gov.kw www.portal.0111etisalat.com trumpvsirancoin.xyz emiratesinvestunion.com +18
URL
http://terymar.com/install/Spf.ps1 http://iuumfgrrnuhb.zhivachkapro.com/pobor
Artifacts (14)
Attack-Report-on-Aviation-Industry.pdf 2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5 077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de 15061036c702ad92b56b35e42cf5dc334597e7311e98d2fdd3815a69ac3b1d84 29b777e7c5470d557e34f3b7b76d2ee291c2dfe7fbaee72821b53eb50a4062c8 0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542 +8
Capability
50%
11 technique(s) 47 tool(s)/malware 4 CVE(s)
Backdoors Botnets Crimson Crimson RAT Custom Backdoor Custom multi‑stage loaders Dark Darkcomp +39
T0835 T1064 T1086
command and control
T1105
execution
T1059.003
impact
T1485 T1498.002
Victim
70%

Targeted Sectors

government defense financial-services healthcare telecommunications critical-infrastructure energy manufacturing education aviation aerospace non-profit media

Targeted Countries

IR IN AE IL PK US SA IQ RU GB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

Backdoors Botnets Crimson
4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

Backdoors Botnets Crimson
6 Command & Control

Capability (Techniques)

T1105 T1021.004

Capability (Malware)

Backdoors Botnets Crimson
7 Actions on Objectives

Capability (Techniques)

T1485 T1498.002

Capability (Malware)

Backdoors Botnets Crimson
Leaving Threaticon

This link opens an external site that isn't part of the platform.