Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
TRIPLESTRENGTH (threat actor)
Risk
80
Critical
11 techniques 47 tools/malware 40 vulnerabilities 22 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
42
T1059.001
PowerShell execution
T1546.001
Change Default File Association privilege escalation
CVE CVE-2023-33538
CVE CVE-2023-6875
CVE CVE-2024-23897
CVE CVE-2025-26385
CVE CVE-2025-46818
CVE CVE-2025-66430
CVE CVE-2026-0257
CVE CVE-2026-0625
CVE CVE-2026-12569
CVE CVE-2026-12957
CVE CVE-2026-15682
CVE CVE-2026-16812
CVE CVE-2026-22769
CVE CVE-2026-25526
CVE CVE-2026-3102
CVE CVE-2026-31431
CVE CVE-2026-34926
CVE CVE-2026-35033
CVE CVE-2026-40369
CVE CVE-2026-41089
CVE CVE-2026-42271
CVE CVE-2026-42897
CVE CVE-2026-46300
CVE CVE-2026-46817
CVE CVE-2026-4782
CVE CVE-2026-4798
CVE CVE-2026-48172
CVE CVE-2026-48331
CVE CVE-2026-48939
CVE CVE-2026-49176
CVE CVE-2026-50522
CVE CVE-2026-5140
CVE CVE-2026-52830
CVE CVE-2026-5386
CVE CVE-2026-56291
CVE CVE-2026-58644
CVE CVE-2026-64638
CVE CVE-2026-8631
CVE CVE-2026-8632
CVE CVE-2026-9082
›
5 Installation
2
T1110
Brute Force credential access
T1133
External Remote Services persistence
›
6 Command & Control
1
T1071.001
Web Protocols command and control
›
7 Actions on Objectives
5
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
T1078
Valid Accounts stealth
Stage risk: Critical High Medium None

Tools & Malware (47)

Akira Backdoors BlackSuit CALENDAR Chaos ClickFix Cobalt Cobalt Strike Cursor Dark Firefox Gemini CLI Gentlemen GitHub Global Infostealer Infostealer malware Infostealer ransomware family Leverage LokiLocker Lynx Microsoft Teams MuddyWater Mythic Node.js PLAY Payload Payload Phishing campaigns Phishing emails Phobos PowerShell RCRU64 Remcos Remcos RAT Royal ScreenConnect SolarWinds Spear-phishing Stealc Telegram Trojan Unknown WhatsApp npm packages phishing unMiner

Indicators of Compromise (22)

Domain
protobuf.js attack.mitre.org Checkout.com Next.js Node.js Fondue.exe ASP.NET vocab.nytimes.txt +10 more
Filename
Node.js Fondue.exe protobuf.js Next.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (5)
M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing M1049 Antivirus/Antimalware
Installation (8)
M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1030 Network Segmentation M1032 Multi-factor Authentication +3 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (16)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +11 more

Detection Coverage

11 strategies
5/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0061 Detect Default File Association Hijack v... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (2)

DET0354 Behavior-chain detection for T1133 Exter... DET0463 Brute Force Authentication Failures with...

Command & Control (1)

DET0027 Detection of Web Protocol-Based C2 Over...

Actions on Objectives (5)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft DET0548 Detection Strategy for Exfiltration Over... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

TRIPLESTRENGTH

Type: Unknown Active
tracked as Antis kanna alprostadil APT28 +11 more
Infrastructure 18 IOC(s)
50%
Domain
protobuf.js attack.mitre.org Checkout.com Next.js Node.js +13
Artifacts (4)
Node.js Fondue.exe protobuf.js Next.js
Capability
50%
11 technique(s) 47 tool(s)/malware 40 CVE(s)
Akira Backdoors BlackSuit CALENDAR Chaos ClickFix Cobalt Cobalt Strike +39
command and control
T1071.001
credential access
T1110
execution
T1059.001
exfiltration
T1048 T1567
Victim
70%

Targeted Sectors

financial-services government healthcare education telecommunications defense critical-infrastructure hospitality energy media retail manufacturing non-profit nuclear gaming pharmaceutical mining aerospace maritime information-technology aviation entertainment food-agriculture construction transportation legal-services utilities

Targeted Countries

CN IR UA GB IN RU PL KP CA JP DE TW IT KR SG RO PK BY AU TR ES MX FR US BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Akira Backdoors BlackSuit
4 Exploitation

Capability (Techniques)

T1059.001 T1546.001

Capability (Malware)

Akira Backdoors BlackSuit
5 Installation

Capability (Techniques)

T1110 T1133

Capability (Malware)

Akira Backdoors BlackSuit
6 Command & Control

Capability (Techniques)

T1071.001

Capability (Malware)

Akira Backdoors BlackSuit
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

Akira Backdoors BlackSuit
Leaving Threaticon

This link opens an external site that isn't part of the platform.