Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UNK_DropPitch (threat actor)
Risk
64
High
5 techniques 50 tools/malware 9 vulnerabilities 40 IOCs 3/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
9
CVE CVE-2018-0171
CVE CVE-2025-29824
CVE CVE-2025-32433
CVE CVE-2025-49704
CVE CVE-2025-49706
CVE CVE-2025-53770
CVE CVE-2025-53771
CVE CVE-2025-6218
CVE CVE-2025-8088
›
5 Installation
No data
›
6 Command & Control
No data
›
7 Actions on Objectives
4
T1531
Account Access Removal impact
T1055
Process Injection stealth
T1053.004
T1053.004
T1086
T1086
Stage risk: Critical High Medium None

Tools & Malware (50)

Babylon RAT Backdoors Beacon Charon ClickFix Cobalt Cobalt Strike Cobalt Strike BEACON Conti Custom malware DCRat EAGLET backdoor Explorer GOVERSHELL Gentlemen Ghost RAT Global Gunra Interlock Interlock ransomware Leverage MINIBIKE MiniBrowse MiniJunk Mythic agent Nimbus Manticore Payload Payload PhantomCore Phishing campaigns Phishing emails PipeMagic PlugX Poseidon backdoor PowerShell PureHVNC RustyClaw Smoke Sandstorm SnipBot Spear Phishing Campaigns Spear-phishing Spear-phishing Campaigns Subtle Snail Unknown UpCrypter Voldemort Voldemort Backdoor WarLock Winrar phishing

Indicators of Compromise (40)

Domain
ema.moctw.info acesportal.com moctw.info ASP.NET Mallory.ai BI.ZONE accshieldportal.com SSL.com +6 more
Email Address
patrick.clawson51@outlook.com patrickclawson51@gmail.com suzannemaloney68@gmail.com
Filename
Intro.zip jli.dll te64.dll Store.vbs powershell.exe javaw.exe schtasks.exe pdf.lnk +5 more
SHA-256 Hash
1016ba708fb21385b12183b3430b64df10a8a1af8355b27dd523d99ca878ffbb 13fad7c6d0accb9e0211a7b26849cf96c333cf6dfa21b40b65a7582b79110e4b
IPv4 Address
82.118.16.72 80.85.156.234 80.85.156.237 45.141.139.222 166.88.61.35 80.85.154.48 80.85.154.101
URL
http://api.moctw.info/Intro.pdf

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

9 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Actions on Objectives (2)
M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint

Detection Coverage

3 strategies
2/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Actions on Objectives (2)

DET0120 Account Access Removal via Multi-Platfor... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UNK_DropPitch

Type: Unknown Active
tracked as Storm-0978 Tropical Scorpius Crouching Yeti Berserk Bear +30 more
Infrastructure 22 IOC(s)
50%
Domain
ema.moctw.info acesportal.com moctw.info ASP.NET Mallory.ai +9
IPv4 Address
82.118.16.72 80.85.156.234 80.85.156.237 45.141.139.222 166.88.61.35 +2
URL
http://api.moctw.info/Intro.pdf
Artifacts (18)
patrick.clawson51@outlook.com patrickclawson51@gmail.com suzannemaloney68@gmail.com Intro.zip jli.dll te64.dll +12
Capability
50%
5 technique(s) 50 tool(s)/malware 9 CVE(s)
Babylon RAT Backdoors Beacon Charon ClickFix Cobalt Cobalt Strike Cobalt Strike BEACON +42
T1053.004 T1086
impact
T1531
initial access
T1566.001
stealth
T1055
Victim
70%

Targeted Sectors

financial-services manufacturing telecommunications defense government education transportation healthcare aerospace retail critical-infrastructure aviation energy food-agriculture construction oil-gas media mining entertainment think-tank nuclear legal-services utilities hospitality

Targeted Countries

CN TW US RU IR BY SG KZ BR CA VN TR IL JP GB AU EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Babylon RAT Backdoors Beacon
7 Actions on Objectives

Capability (Techniques)

T1531

Capability (Malware)

Babylon RAT Backdoors Beacon
Leaving Threaticon

This link opens an external site that isn't part of the platform.