Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Earth Lamia (threat actor)
Risk
100
Critical
40 techniques 46 tools/malware 40 vulnerabilities 39 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
4
T1590
Gather Victim Network Information reconnaissance
T1592
Gather Victim Host Information reconnaissance
T1595.001
Scanning IP Blocks reconnaissance
T1595.002
Vulnerability Scanning reconnaissance
›
2 Weaponization
5
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1587.001
Malware resource development
T1608.001
Upload Malware resource development
T1608.002
Upload Tool resource development
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
44
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2012-0158
CVE CVE-2017-11882
CVE CVE-2017-9805
CVE CVE-2019-6693
CVE CVE-2021-22205
CVE CVE-2021-40539
CVE CVE-2021-44228
CVE CVE-2023-38950
CVE CVE-2023-38951
CVE CVE-2023-38952
CVE CVE-2023-46805
CVE CVE-2023-4966
CVE CVE-2023-52271
CVE CVE-2024-11182
CVE CVE-2024-21412
CVE CVE-2024-21762
CVE CVE-2024-21893
CVE CVE-2024-27198
CVE CVE-2024-27199
CVE CVE-2024-37085
CVE CVE-2024-40766
CVE CVE-2024-51378
CVE CVE-2024-51567
CVE CVE-2024-55591
CVE CVE-2024-56145
CVE CVE-2024-57726
CVE CVE-2024-57727
CVE CVE-2024-9047
CVE CVE-2025-31161
CVE CVE-2025-31324
CVE CVE-2025-33053
CVE CVE-2025-44277
CVE CVE-2025-44288
CVE CVE-2025-53771
CVE CVE-2025-55182
CVE CVE-2025-55183
CVE CVE-2025-55184
CVE CVE-2025-61155
CVE CVE-2025-67779
CVE CVE-2025-8088
›
5 Installation
8
T1003.001
LSASS Memory credential access
T1003.002
Security Account Manager credential access
T1087.001
Local Account discovery
T1087.002
Domain Account discovery
T1482
Domain Trust Discovery discovery
T1098.007
Additional Local or Domain Groups persistence
T1136.001
Local Account persistence
T1505.003
Web Shell persistence
›
6 Command & Control
9
T1005
Data from Local System collection
T1008
Fallback Channels command and control
T1095
Non-Application Layer Protocol command and control
T1104
Multi-Stage Channels command and control
T1105
Ingress Tool Transfer command and control
T1132.001
Standard Encoding command and control
T1571
Non-Standard Port command and control
T1573.001
Symmetric Cryptography command and control
T1570
Lateral Tool Transfer lateral movement
›
7 Actions on Objectives
9
T1041
Exfiltration Over C2 Channel exfiltration
T1036.005
Match Legitimate Resource Name or Location stealth
T1078
Valid Accounts stealth
T1078.003
Local Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1574.001
DLL stealth
T1620
Reflective Code Loading stealth
T1070.001
T1070.001
T1562.001
T1562.001
Stage risk: Critical High Medium None

Tools & Malware (46)

0day CVE-2018-8453 Anubis Backdoors BypassBoss COMPOOD CVE-2018-8611 ClickFix Cobalt Cobalt Strike DragonForce DragonForce ransomware GitHub Global HermeticWiper JuicyPotato LockBit MINOCAT MS16-120 / CVE-2016-3393 0day exploits Matrix MuddyWater Nexus Owowa PULSEPACK PathWiper Payload Payload PhantomCore Phishing emails PowerShell PowerShell Backdoor PowerShell backdoor SNOWLIGHT STOWAWAY Sednit ShadowPad Spear-phishing Spear-phishing emails Telegram Unknown VShell Void Web Shells XMRIG curl phishing schtasks

Indicators of Compromise (39)

Domain
protection.Identify BI.ZONE mail.ru outbreak.Find events.Develop Zagrebator.Dropper kzst45.ru mysterykamchatka.ru +6 more
Filename
conditions.rar Document.hta pdf.scr pdf.exe xsl.scr xlsx.scr AppLaunch.exe threat-actor-profiles-tlpclear.pdf +14 more
SHA-256 Hash
7f05bad031d22c2bb4352bf0b6b9ee2ca064a4c0e11a317e6fedc694de37737a
IPv4 Address
43.247.135.53 103.30.76.206

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (12)
M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +7 more
Installation (12)
M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +7 more
Command & Control (5)
M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit M1057 Data Loss Prevention
Actions on Objectives (16)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +11 more

Detection Coverage

38 strategies
7/7 stages covered

Reconnaissance (4)

DET0817 Detection of Scanning IP Blocks DET0826 Detection of Gather Victim Host Informat... DET0867 Detection of Vulnerability Scanning DET0869 Detection of Gather Victim Network Infor...

Weaponization (5)

DET0824 Detection of Upload Malware DET0834 Detection of Upload Tool DET0838 Detection of Virtual Private Server DET0872 Detection of Malware DET0892 Detection of Domains

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (4)

DET0202 Behavioral Detection of Windows Command... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0514 Detection Strategy for Exploitation for...

Installation (8)

DET0007 Detection of Domain Trust Discovery via... DET0085 Credential Dumping from SAM via Registry... DET0129 Domain Account Enumeration Across Platfo... DET0303 Local Account Enumeration Across Host Pl... DET0310 Suspicious Addition to Local or Domain G... +3 more

Command & Control (9)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0124 Behavior-chain detection for T1132.001 D... DET0143 Detection Strategy for Encrypted Channel... DET0183 Detection Strategy for Lateral Tool Tran... DET0227 Detection Strategy for Non-Standard Port... +4 more

Actions on Objectives (7)

DET0201 Detection Strategy for Hijack Execution... DET0275 Detect Adversary Deobfuscation or Decodi... DET0300 Detection Strategy for Reflective Code L... DET0347 Detection Strategy for Masquerading via... DET0348 Detection Strategy for Exfiltration Over... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Earth Lamia

Type: Unknown Active
UNC5454 APT28 Fancy Bear tracked as Paper Werewolf +30 more
Infrastructure 16 IOC(s)
50%
Domain
protection.Identify BI.ZONE mail.ru outbreak.Find events.Develop +9
IPv4 Address
43.247.135.53 103.30.76.206
Artifacts (23)
conditions.rar Document.hta pdf.scr pdf.exe xsl.scr xlsx.scr +17
Capability
52%
40 technique(s) 46 tool(s)/malware 40 CVE(s)
0day CVE-2018-8453 Anubis Backdoors BypassBoss COMPOOD CVE-2018-8611 ClickFix Cobalt +38
T1070.001 T1562.001
collection
T1005
command and control
T1008 T1095 T1104 T1105 +3
credential access
T1003.001 T1003.002
Victim
70%

Targeted Sectors

financial-services government transportation energy defense telecommunications education retail manufacturing critical-infrastructure utilities construction healthcare media aerospace maritime nuclear non-profit aviation oil-gas

Targeted Countries

IN BR CN RU TW KR TR UA IL AE CA US IR JP VN SA AU middle_east

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Malware)

0day CVE-2018-8453 Anubis Backdoors
2 Weaponization

Capability (Malware)

0day CVE-2018-8453 Anubis Backdoors
3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

0day CVE-2018-8453 Anubis Backdoors
4 Exploitation

Capability (Malware)

0day CVE-2018-8453 Anubis Backdoors
5 Installation

Capability (Malware)

0day CVE-2018-8453 Anubis Backdoors
6 Command & Control

Capability (Malware)

0day CVE-2018-8453 Anubis Backdoors
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

0day CVE-2018-8453 Anubis Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.