Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Swan Vector (threat actor)
Risk
86
Critical
16 techniques 61 tools/malware 40 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
45
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059.003
Windows Command Shell execution
T1059.007
JavaScript execution
T1203
Exploitation for Client Execution execution
CVE CVE-2023-26359
CVE CVE-2023-2868
CVE CVE-2023-32315
CVE CVE-2023-33538
CVE CVE-2023-36844
CVE CVE-2023-36845
CVE CVE-2023-38035
CVE CVE-2023-38180
CVE CVE-2023-38831
CVE CVE-2023-6875
CVE CVE-2024-23897
CVE CVE-2025-26385
CVE CVE-2025-33053
CVE CVE-2025-66430
CVE CVE-2026-0257
CVE CVE-2026-0625
CVE CVE-2026-12569
CVE CVE-2026-12957
CVE CVE-2026-15682
CVE CVE-2026-16812
CVE CVE-2026-21509
CVE CVE-2026-22769
CVE CVE-2026-25526
CVE CVE-2026-31431
CVE CVE-2026-35033
CVE CVE-2026-41089
CVE CVE-2026-42271
CVE CVE-2026-46817
CVE CVE-2026-48331
CVE CVE-2026-48939
CVE CVE-2026-49176
CVE CVE-2026-50522
CVE CVE-2026-52830
CVE CVE-2026-5386
CVE CVE-2026-56291
CVE CVE-2026-58644
CVE CVE-2026-64638
CVE CVE-2026-8631
CVE CVE-2026-8632
CVE CVE-2026-9082
›
5 Installation
2
T1003
OS Credential Dumping credential access
T1547.009
Shortcut Modification persistence
›
6 Command & Control
2
T1021.001
Remote Desktop Protocol lateral movement
T1021.002
SMB/Windows Admin Shares lateral movement
›
7 Actions on Objectives
5
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1055.005
Thread Local Storage stealth
T1078
Valid Accounts stealth
T1218.014
MMC stealth
Stage risk: Critical High Medium None

Tools & Malware (61)

Akira Apollo Babuk Backdoors BrockenDoor Chaos ClickFix Cobalt Cobalt Strike Cursor Custom reflective injector Dark DarkGate Elise (Trensil) Firefox Gemini CLI Gentlemen GitHub GlassWorm Global Horus Agent Infostealer Leverage LockBit Maze Microsoft Teams Mimikatz MuddyWater Nexus Node.js PDQ PLAY Payload Payload Phishing campaigns Phishing emails PlugX PowerShell Quasar RAT Remcos Remcos RAT ScreenConnect ShadowPad Silent Werewolf SolarWinds Spear-phishing SpyPress.HORDE SpyPress.MDAEMON SpyPress.ROUNDCUBE SpyPress.ZIMBRA Stealc SynChro Telegram Trojan Unknown WhatsApp Winrar XRed iediagcmd.exe npm packages phishing

Indicators of Compromise (40)

Domain
Freeze.rs freevector.com Zagrebator.Dropper ANY.RUN cisa.gov mail.ru demo-cloud.space Android.MagicAd +12 more
Email Address
LCSC_IE@infosec.exchange
Filename
fsutil.exe Node.js Fondue.exe protobuf.js explorer.exe pdf.lnk noblox.js msinfo32.exe +11 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (11)
M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +6 more
Installation (12)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +7 more
Command & Control (10)
M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation +5 more
Actions on Objectives (12)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +7 more

Detection Coverage

16 strategies
5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0287 Exploitation for Client Execution – cros... DET0364 Behavioral Detection Strategy for WMI Ex... DET0441 Detection of Suspicious Scheduled Task C...

Installation (2)

DET0180 Detection Strategy for T1547.009 – Short... DET0234 Credential Dumping via Sensitive Memory...

Command & Control (2)

DET0327 Multi-event Detection Strategy for RDP-B... DET0530 Multi-Event Detection for SMB Admin Shar...

Actions on Objectives (5)

DET0146 Detection of Data Destruction Across Pla... DET0215 Detection of Multi-Platform File Encrypt... DET0222 Detecting MMC (.msc) Proxy Execution and... DET0467 Detection Strategy for TLS Callback Inje... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Swan Vector

Type: Unknown Active
Fancy Bear Cozy Bear APT28 The Dukes Sofacy +76 more
Infrastructure 20 IOC(s)
50%
Domain
Freeze.rs freevector.com Zagrebator.Dropper ANY.RUN cisa.gov +15
Artifacts (20)
LCSC_IE@infosec.exchange fsutil.exe Node.js Fondue.exe protobuf.js explorer.exe +14
Capability
50%
16 technique(s) 61 tool(s)/malware 40 CVE(s)
Akira Apollo Babuk Backdoors BrockenDoor Chaos ClickFix Cobalt +53
credential access
T1003
execution
T1047 T1053.005 T1059.003 T1059.007 +1
impact
T1485 T1486
initial access
T1190 T1566.001
Victim
70%

Targeted Sectors

financial-services government defense energy healthcare telecommunications education critical-infrastructure manufacturing non-profit media hospitality retail transportation aerospace nuclear utilities gaming pharmaceutical construction aviation maritime legal-services mining think-tank information-technology oil-gas chemical

Targeted Countries

CN TW JP RU UA IR KR IN PL GB US DE TR AU IT ES KP SG CA VN RO BR IL SA MX FR AE PK BY AZ KZ EG NL NG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Akira Apollo Babuk
4 Exploitation

Capability (Malware)

Akira Apollo Babuk
5 Installation

Capability (Techniques)

T1003 T1547.009

Capability (Malware)

Akira Apollo Babuk
6 Command & Control

Capability (Techniques)

T1021.001 T1021.002

Capability (Malware)

Akira Apollo Babuk
7 Actions on Objectives

Capability (Techniques)

T1485 T1486

Capability (Malware)

Akira Apollo Babuk
Leaving Threaticon

This link opens an external site that isn't part of the platform.