Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Earth Alux (threat actor)
Risk
73
High
9 techniques 52 tools/malware 26 vulnerabilities 39 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
28
T1059.001
PowerShell execution
T1203
Exploitation for Client Execution execution
CVE CVE-2009-3960
CVE CVE-2010-2861
CVE CVE-2018-13379
CVE CVE-2019-0604
CVE CVE-2019-3980
CVE CVE-2021-26855
CVE CVE-2021-26857
CVE CVE-2021-26858
CVE CVE-2021-27065
CVE CVE-2021-31207
CVE CVE-2021-34473
CVE CVE-2021-34523
CVE CVE-2022-41352
CVE CVE-2023-23397
CVE CVE-2023-2868
CVE CVE-2023-32315
CVE CVE-2023-36802
CVE CVE-2023-42793
CVE CVE-2023-48788
CVE CVE-2024-1709
CVE CVE-2025-0411
CVE CVE-2025-49704
CVE CVE-2025-49706
CVE CVE-2025-53770
CVE CVE-2025-53771
CVE CVE-2025-55182
›
5 Installation
No data
›
6 Command & Control
2
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
3
T1112
Modify Registry defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1486
Data Encrypted for Impact impact
Stage risk: Critical High Medium None

Tools & Malware (52)

AnyDesk Backdoors Beacon C#‑based obfuscated loader COBEACON backdoor Cobalt Cobalt Strike Cring Evil-CreateDump Explorer FINALDRAFT FatalRat GCat GODZILLA web shell Global Godzilla GreyEngergy Mini as their 1st-stage implant J-magic Jewelbug Leverage Loki MASQLOADER Merlin Merlin agent Mythic NOODLERAT OlympicDestroyer Payload Payload Phishing emails Polyglot PowerShell RAILSETTER RSBINJECT Rootkit Sagerunex Sagerunex backdoor ShadowPad SlowStepper Smokeloader Telegram Trojan Unknown VARGEIT backdoor VIP Keylogger VeilShell Trojan Web Shell Web Shells Winnti Winnti malware cd00r phishing

Indicators of Compromise (39)

Domain
crostech.ru rtu.txt thelightpower.info mail.gkrzn.ru fleetdm.com Mallory.ai ad.domain charcode.aspx +5 more
Filename
regsvr32.exe cdb.exe fdp.dll nfdp.dll TosBtKbd.dll RuntimeBroker.exe mdync.exe nvcontainer.exe +17 more
IPv4 Address
96.9.125.227

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (13)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +8 more
Exploitation (8)
M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing M1048 Application Isolation and Sandboxing +3 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (5)
M1024 Restrict Registry Permissions M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup M1057 Data Loss Prevention

Detection Coverage

9 strategies
4/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0455 Abuse of PowerShell for Arbitrary Execut...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (3)

DET0215 Detection of Multi-Platform File Encrypt... DET0280 Behavior-Based Registry Modification Det... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Earth Alux

Type: Unknown Active
CL-STA-0049 REF7707 tracked as in Red Report 2026 Ink Dragon +45 more
Infrastructure 14 IOC(s)
50%
Domain
crostech.ru rtu.txt thelightpower.info mail.gkrzn.ru fleetdm.com +8
IPv4 Address
96.9.125.227
Artifacts (25)
regsvr32.exe cdb.exe fdp.dll nfdp.dll TosBtKbd.dll RuntimeBroker.exe +19
Capability
51%
9 technique(s) 52 tool(s)/malware 26 CVE(s)
AnyDesk Backdoors Beacon C#‑based obfuscated loader COBEACON backdoor Cobalt Cobalt Strike Cring +44
command and control
T1071.001 T1105
defense impairment
T1112
execution
T1059.001 T1203
exfiltration
T1041
Victim
70%

Targeted Sectors

government telecommunications manufacturing transportation financial-services defense energy critical-infrastructure retail construction oil-gas maritime pharmaceutical information-technology healthcare aerospace aviation education entertainment utilities nuclear mining media chemical legal-services

Targeted Countries

CN RU US BR TW AE VN JP UA KR SG GB PK IL IR AU PL NL europe

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.002

Capability (Malware)

AnyDesk Backdoors Beacon
4 Exploitation

Capability (Techniques)

T1059.001 T1203

Capability (Malware)

AnyDesk Backdoors Beacon
6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

AnyDesk Backdoors Beacon
7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

AnyDesk Backdoors Beacon
Leaving Threaticon

This link opens an external site that isn't part of the platform.