Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
INDOHAXSEC TEAM (threat actor)
Risk
62
High
3 techniques 48 tools/malware 6 vulnerabilities 38 IOCs 3/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
7
T1059
Command and Scripting Interpreter execution
CVE CVE-2015-1701
CVE CVE-2026-0257
CVE CVE-2026-18556
CVE CVE-2026-18577
CVE CVE-2026-28299
CVE CVE-2026-28323
›
5 Installation
No data
›
6 Command & Control
1
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
1
T1499
Endpoint Denial of Service impact
Stage risk: Critical High Medium None

Tools & Malware (48)

Ark‑Cheat‑Detector Aurora Avaa Bypassed Backdoors Cobalt Conti Crimson DONOT Dancokware Dark FidzXploit FunkSec Ghost RAT GitHub Global Grizzly Steppe Hidden Cobra Hunter Jackal Kimsuky Lynx Mimikatz MiniDionis Mirage NUKLIR Naikon Nexus OilRig Phishing emails Phoenix Poseidon Qilin RansomHub SeaDuke Sednit Sofacy Spear-phishing TeamSpy Telegram Unknown VICEROY Void WannaCry WannaCry 2.0 Xss_Fucker phishing warning.php white.php

Indicators of Compromise (38)

Domain
misil.py TEMP.Hippo TEMP.Zhenbao TEMP.Noble TMP.Lapis warning.php indohaxsec.php 404.php +14 more
Filename
Node.js
SHA-256 Hash
eae18c62dbb29bc6749347d410a16b190cb1b2fdaff6d8318ca9ecb5e572391d 02c3d44ec9a44558f516a5922b09b736c5786d2a675b89b2e86ce8f16e4041b6 cd8a7350b07311f2257eba7ed5d992cf7f00e869461f9a2c3c2003a05bfdcce0 efd85fd28bcf10f32f0ac934ee0e9e71d34a0cbae66ee83abad9a929c3ca91f9 9391014b5a567f4821603c97802c38d8f3053469f47533c57bcfdb787fd9cd57 658f468bc8a762ebef233d284bccb97d64d5b214ea49d9c1cac8b9976ee6c3dc 09092c5061322e3cdc33e3eb4d8379f77ec20ff121acd42b159e87407e421a57 9325343e22181eda59efce7b9d6a54c5565c1798337cb42f07a24dbe93f5b117 +7 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

11 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Exploitation (9)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (1)
M1037 Filter Network Traffic

Detection Coverage

3 strategies
3/7 stages covered

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0208 Endpoint Resource Saturation and Crash P...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

INDOHAXSEC TEAM

Type: Unknown Active
cpyy APT3 Gothic Panda UPS Team TG-0110 +11 more
Infrastructure 22 IOC(s)
50%
Domain
misil.py TEMP.Hippo TEMP.Zhenbao TEMP.Noble TMP.Lapis +17
Artifacts (16)
Node.js eae18c62dbb29bc6749347d410a16b190cb1b2fdaff6d8318ca9ecb5e572391d 02c3d44ec9a44558f516a5922b09b736c5786d2a675b89b2e86ce8f16e4041b6 cd8a7350b07311f2257eba7ed5d992cf7f00e869461f9a2c3c2003a05bfdcce0 efd85fd28bcf10f32f0ac934ee0e9e71d34a0cbae66ee83abad9a929c3ca91f9 9391014b5a567f4821603c97802c38d8f3053469f47533c57bcfdb787fd9cd57 +10
Capability
50%
3 technique(s) 48 tool(s)/malware 6 CVE(s)
Ark‑Cheat‑Detector Aurora Avaa Bypassed Backdoors Cobalt Conti Crimson DONOT +40
command and control
T1105
execution
T1059
impact
T1499
Victim
70%

Targeted Sectors

government defense financial-services non-profit telecommunications aerospace energy media healthcare pharmaceutical education information-technology maritime manufacturing think-tank entertainment gaming chemical retail hospitality transportation nuclear construction food-agriculture legal-services mining

Targeted Countries

US CN GB IN KR JP DE RU IL FR CA IR SA TW TR AU PK KZ ES BR SG NL IT UA PL BY VN IQ RO MX AE AZ SY LB EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1059
6 Command & Control

Capability (Techniques)

T1105
7 Actions on Objectives

Capability (Techniques)

T1499
Leaving Threaticon

This link opens an external site that isn't part of the platform.