Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Storm-2077 (threat actor)
Risk
90
Critical
14 techniques 40 tools/malware 4 vulnerabilities 39 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1590.006
Network Security Appliances reconnaissance
›
2 Weaponization
1
T1583.003
Virtual Private Server resource development
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
8
T1203
Exploitation for Client Execution execution
T1204
User Execution execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
CVE CVE-2022-3019
CVE CVE-2022-30190
CVE CVE-2024-24919
CVE CVE-2024-3400
›
5 Installation
1
T1046
Network Service Discovery discovery
›
6 Command & Control
4
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1571
Non-Standard Port command and control
T1021
Remote Services lateral movement
›
7 Actions on Objectives
1
T1567.002
Exfiltration to Cloud Storage exfiltration
Stage risk: Critical High Medium None

Tools & Malware (40)

AppDomainManager BITS BRICKSTORM BRICKSTORM backdoor Backdoors Beacon ClickFix Cloudflare Workers Cobalt Cobalt Strike Exploit code GitHub Global Group Policy Handala Heroku Hook Interception Leslieloader MSBuild Matrix Microsoft Teams Open-source tools Pantegana Phishing emails PowerShell Process Hollowing Rogue SLAYSTYLE STOP SparkRAT Unknown Web Shell Windows Command Shell YARA Zero-day exploits macOS ClickFix netsh phishing systemd

Indicators of Compromise (39)

Domain
demo-cloud.space Mallory.ai c1.metadata c1.target.ip c1.principal.hostname c1.principal c1.target.port c1.target.url +15 more
Filename
enterprise-attack-v18.1-campaigns.xlsx
SHA-256 Hash
8679a25c78e104c6e74996b75882e378f420614fe1379ee9c1e266a11ffa096d 06e87a03507213322d876b459194021f876ba90f85c5faa401820954045cd1d2 675874ac8fbe66e76244759ae398a4d30da84ef2435a1384c4be549ca9eba18b 1e37efcd3cd647e6ce5414ae8e353ca690c2d3f7a701a1cc2ec29a4813f5c90b dba860617762bc713771de351026eb683546b37489fa0359064948f263438030 134ed0407956ff1ac59f38e89742e357cc3be565cbaff18b424ed1bcfd130978 2bee2cc42322e928bfa0650c5416b14bc0200f2d1156304179d63982baa835dc 9a1077f57bac5610d44ac46a8958dd5469522a3db466f164f4dfeada73847b79
IPv4 Address
209.141.46.57 198.98.50.218 209.141.57.116 205.185.126.208 209.141.47.6 47.103.218.35 209.141.46.24

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (9)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +4 more
Installation (3)
M1030 Network Segmentation M1031 Network Intrusion Prevention M1042 Disable or Remove Feature or Program
Command & Control (9)
M1018 User Account Management M1027 Password Policies M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +4 more
Actions on Objectives (1)
M1021 Restrict Web-Based Content

Detection Coverage

14 strategies
7/7 stages covered

Reconnaissance (1)

DET0889 Detection of Network Security Appliances

Weaponization (1)

DET0838 Detection of Virtual Private Server

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0066 User Execution – Malicious Link (click →... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0478 User Execution – multi-surface behavior...

Installation (1)

DET0376 Behavioral Detection Strategy for Networ...

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0227 Detection Strategy for Non-Standard Port... DET0269 Behavioral Detection Strategy for Remote... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (1)

DET0570 Detection Strategy for Exfiltration to C...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Storm-2077

Type: Unknown Active
TAG-100 RedNovember overlapping with Storm-2077
Infrastructure 30 IOC(s)
50%
Domain
demo-cloud.space Mallory.ai c1.metadata c1.target.ip c1.principal.hostname +18
IPv4 Address
209.141.46.57 198.98.50.218 209.141.57.116 205.185.126.208 209.141.47.6 +2
Artifacts (9)
enterprise-attack-v18.1-campaigns.xlsx 8679a25c78e104c6e74996b75882e378f420614fe1379ee9c1e266a11ffa096d 06e87a03507213322d876b459194021f876ba90f85c5faa401820954045cd1d2 675874ac8fbe66e76244759ae398a4d30da84ef2435a1384c4be549ca9eba18b 1e37efcd3cd647e6ce5414ae8e353ca690c2d3f7a701a1cc2ec29a4813f5c90b dba860617762bc713771de351026eb683546b37489fa0359064948f263438030 +3
Capability
50%
14 technique(s) 40 tool(s)/malware 4 CVE(s)
AppDomainManager BITS BRICKSTORM BRICKSTORM backdoor Backdoors Beacon ClickFix Cloudflare Workers +32
command and control
T1071 T1071.001 T1571
discovery
T1046
execution
T1203 T1204 T1204.001 T1204.002
exfiltration
T1567.002
Victim
70%

Targeted Sectors

government defense financial-services aerospace legal-services education telecommunications transportation critical-infrastructure non-profit manufacturing nuclear utilities media healthcare construction aviation information-technology

Targeted Countries

US CN TW KR GB KP IR IL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1590.006

Capability (Malware)

AppDomainManager BITS BRICKSTORM
2 Weaponization

Capability (Techniques)

T1583.003

Capability (Malware)

AppDomainManager BITS BRICKSTORM
3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

AppDomainManager BITS BRICKSTORM
4 Exploitation

Capability (Malware)

AppDomainManager BITS BRICKSTORM
5 Installation

Capability (Techniques)

T1046

Capability (Malware)

AppDomainManager BITS BRICKSTORM
6 Command & Control

Capability (Malware)

AppDomainManager BITS BRICKSTORM
7 Actions on Objectives

Capability (Techniques)

T1567.002

Capability (Malware)

AppDomainManager BITS BRICKSTORM
Leaving Threaticon

This link opens an external site that isn't part of the platform.