Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
TAG-112 (threat actor)
Risk
100
Critical
34 techniques 45 tools/malware 5 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1594
Search Victim-Owned Websites reconnaissance
›
2 Weaponization
3
T1583.004
Server resource development
T1583.006
Web Services resource development
T1584.004
Server resource development
›
3 Delivery
2
T1189
Drive-by Compromise initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
7
T1204
User Execution execution
T1569.002
Service Execution execution
CVE CVE-2015-5119
CVE CVE-2017-11882
CVE CVE-2022-42475
CVE CVE-2024-3400
CVE CVE-2025-22457
›
5 Installation
3
T1555.003
Credentials from Web Browsers credential access
T1505.003
Web Shell persistence
T1543.003
Windows Service persistence
›
6 Command & Control
5
T1005
Data from Local System collection
T1560.001
Archive via Utility collection
T1071.001
Web Protocols command and control
T1071.003
Mail Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
18
T1112
Modify Registry defense impairment
T1567.002
Exfiltration to Cloud Storage exfiltration
T1486
Data Encrypted for Impact impact
T1027
Obfuscated Files or Information stealth
T1027.013
Encrypted/Encoded File stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1070
Indicator Removal stealth
T1070.003
Clear Command History stealth
T1070.004
File Deletion stealth
T1070.005
Network Share Connection Removal stealth
T1070.006
Timestomp stealth
T1070.007
Clear Network Connection History and Configurations stealth
T1070.008
Clear Mailbox Data stealth
T1070.009
Clear Persistence stealth
T1070.010
Relocate Malware stealth
T1574.001
DLL stealth
T1107
T1107
T1574.002
T1574.002
Stage risk: Critical High Medium None

Tools & Malware (45)

BRICKSTORM Backdoor.Oldrea Beacon Bisonal Black Basta BlackByte BlackByte Ransomware ChocoShell ClickFix Cobalt Cobalt Strike CornFlake DUSTPAN DUSTTRAP Global Heyoka Backdoor Hydraq InvisiMole Joomla KONNI Kimsuky LockBit LockBit 2.0 LockBit 3.0 Medusa Medusa Ransomware Metamorfo Mosquito Nexus OceanLotus OilRig PINEGROVE Payload Payload PlugX PowerShell Qilin REvil SUNBURST ShrinkLocker Trojan Turla White Company njRAT phishing

Indicators of Compromise (40)

Domain
auth.json www.digicert.com www.eloples.com dnspod.cn p.txt uldrdata.txt FalconFeeds.io class-woocommerce.php +14 more
Filename
conn.exe rundll32.exe svchost.exe dbgeng.dll remover.bat cmd.exe sqluldr.exe svchost32.exe +2 more
SHA-1 Hash
d4938cb5c031ec7f04d73d4e75f5db5c8a5c04ce
SHA-256 Hash
94569f64f62eff185ba47e991dba54bdeea6d1a9e205d6bec767be6a864e4efb d0972247c500d2a45f412f9434287161de395a35ef5b4931cba12cf513b76962
IPv4 Address
8.137.112.245 154.90.63.166 154.90.62.12 152.89.244.185 154.205.138.202

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (8)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1048 Application Isolation and Sandboxing +3 more
Exploitation (8)
M1017 User Training M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1031 Network Intrusion Prevention +3 more
Installation (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1028 Operating System Configuration +5 more
Command & Control (4)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit M1057 Data Loss Prevention
Actions on Objectives (16)
M1013 Application Developer Guidance M1017 User Training M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +11 more

Detection Coverage

32 strategies
7/7 stages covered

Reconnaissance (1)

DET0810 Detection of Search Victim-Owned Website...

Weaponization (3)

DET0871 Detection of Server DET0874 Detection of Server DET0896 Detection of Web Services

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (2)

DET0421 Detection Strategy for System Services S... DET0478 User Execution – multi-surface behavior...

Installation (3)

DET0037 Detect Suspicious Access to Browser Cred... DET0394 Web Shell Detection via Server Behavior... DET0552 Detection of Windows Service Creation or...

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0135 Detection of Mail Protocol-Based C2 Acti... DET0298 Detect Archiving via Utility (T1560.001) DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (16)

DET0040 Detection of Persistence Artifact Remova... DET0049 Behavioral Detection of Network History... DET0087 Encrypted or Encoded File Payload Detect... DET0103 Behavioral Detection of Network Share Co... DET0140 Behavioral Detection of Malicious File D... +11 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

TAG-112

Type: Unknown Active
tag propagation Advanced Persistent Threat 39 Chafer Cadelspy Remexi +7 more
Infrastructure 27 IOC(s)
50%
Domain
auth.json www.digicert.com www.eloples.com dnspod.cn p.txt +17
IPv4 Address
8.137.112.245 154.90.63.166 154.90.62.12 152.89.244.185 154.205.138.202
Artifacts (13)
conn.exe rundll32.exe svchost.exe dbgeng.dll remover.bat cmd.exe +7
Capability
50%
34 technique(s) 45 tool(s)/malware 5 CVE(s)
BRICKSTORM Backdoor.Oldrea Beacon Bisonal Black Basta BlackByte BlackByte Ransomware ChocoShell +37
T1107 T1574.002
collection
T1005 T1560.001
command and control
T1071.001 T1071.003 T1105
credential access
T1555.003
Victim
70%

Targeted Sectors

government defense financial-services energy transportation education critical-infrastructure healthcare media maritime hospitality telecommunications gaming non-profit information-technology entertainment utilities aerospace think-tank aviation retail

Targeted Countries

CN UA US RU TW KR IR AZ JP CA IN PK BY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1594

Capability (Malware)

BRICKSTORM Backdoor.Oldrea Beacon
2 Weaponization

Capability (Techniques)

T1583.004 T1583.006 T1584.004

Capability (Malware)

BRICKSTORM Backdoor.Oldrea Beacon
3 Delivery

Capability (Techniques)

T1189 T1566.002

Capability (Malware)

BRICKSTORM Backdoor.Oldrea Beacon
4 Exploitation

Capability (Techniques)

T1204 T1569.002

Capability (Malware)

BRICKSTORM Backdoor.Oldrea Beacon
5 Installation

Capability (Techniques)

T1555.003 T1505.003 T1543.003

Capability (Malware)

BRICKSTORM Backdoor.Oldrea Beacon
6 Command & Control

Capability (Malware)

BRICKSTORM Backdoor.Oldrea Beacon
7 Actions on Objectives

Capability (Techniques)

T1567.002 T1486

Capability (Malware)

BRICKSTORM Backdoor.Oldrea Beacon
Leaving Threaticon

This link opens an external site that isn't part of the platform.