Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
LongNosedGoblin (threat actor)
Risk
90
Critical
37 techniques 64 tools/malware 3 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
2
T1585.003
Cloud Accounts resource development
T1588.001
Malware resource development
›
3 Delivery
1
T1566
Phishing initial access
›
4 Exploitation
8
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1106
Native API execution
CVE CVE-2025-0994
CVE CVE-2025-20333
CVE CVE-2025-20362
›
5 Installation
3
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1217
Browser Information Discovery discovery
›
6 Command & Control
12
T1056
Input Capture collection
T1056.001
Keylogging collection
T1074.001
Local Data Staging collection
T1113
Screen Capture collection
T1125
Video Capture collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1102.002
Bidirectional Communication command and control
T1105
Ingress Tool Transfer command and control
T1573.001
Symmetric Cryptography command and control
T1573.002
Asymmetric Cryptography command and control
›
7 Actions on Objectives
14
T1484.001
Group Policy Modification defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1567.002
Exfiltration to Cloud Storage exfiltration
T1027.013
Encrypted/Encoded File stealth
T1027.015
Compression stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1055
Process Injection stealth
T1218
System Binary Proxy Execution stealth
T1480
Execution Guardrails stealth
T1564.003
Hidden Window stealth
T1574.014
AppDomainManager stealth
T1620
Reflective Code Loading stealth
T1622
Debugger Evasion stealth
T1562.001
T1562.001
Stage risk: Critical High Medium None

Tools & Malware (64)

ATI-Agent AdobeARM Agent.btz Agent.dne AppDomainManager Backdoors CloudSorcerer v3 Cobalt Cobalt Strike Crisis Custom Backdoor Custom backdoors Donut DracuLoader Explorer FFmpeg FINALDRAFT Firefox Gazer GitHub Global Google Drive Group Policy Impacket Microsoft OneDrive MiniDionis MuddyWater Nautilus Net NetDraft Neuron Nexus NosyDoor NosyDownloader NosyHistorian OilRig Payload Payload PowerShell ReverseSocks5 Rootkit RoundCube SNAPPYBEE SNOWLIGHT STOWAWAY Sednit ShadowPad Systeminfo Tasklist Tavdig Turla UAT-8302 Unknown Uroburos VSHELL VShell WhiteBear Wipbot ZingDoor gpresult phishing pwdump schtasks wce

Indicators of Compromise (40)

Domain
History.ini Registry.plo log.cached test.ini Win.Malware.Netdraft Patched.NLL Agent.ESF netfxsbs9.hkf +15 more
Filename
ntrtscan.exe cmd.exe explorer.exe spoolsv.exe notepad.exe mscorsvc.dll run.bat wagent.exe +7 more
IPv4 Address
118.107.234.29 85.209.156.3

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (6)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more
Exploitation (11)
M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1033 Limit Software Installation +6 more
Command & Control (5)
M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit
Actions on Objectives (16)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1031 Network Intrusion Prevention +11 more

Detection Coverage

36 strategies
6/7 stages covered

Weaponization (2)

DET0845 Detection of Malware DET0846 Detection of Cloud Accounts

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri... DET0529 Behavioral Detection of Native API Invoc...

Installation (3)

DET0013 Detection of Local Browser Artifact Acce... DET0370 Recursive Enumeration of Files and Direc... DET0525 System Discovery via Native and Remote U...

Command & Control (12)

DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0102 Behavioral Detection of Input Capture Ac... +7 more

Actions on Objectives (13)

DET0081 Detection of Proxy Execution via Trusted... DET0087 Encrypted or Encoded File Payload Detect... DET0128 Detection Strategy for Hidden Windows DET0281 Detection Strategy for Compressed Payloa... DET0300 Detection Strategy for Reflective Code L... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

LongNosedGoblin

Type: Unknown Active
APT34 Earth Preta Stately Taurus tracked as Midnight Blizzard has +85 more
Infrastructure 25 IOC(s)
50%
Domain
History.ini Registry.plo log.cached test.ini Win.Malware.Netdraft +18
IPv4 Address
118.107.234.29 85.209.156.3
Artifacts (15)
ntrtscan.exe cmd.exe explorer.exe spoolsv.exe notepad.exe mscorsvc.dll +9
Capability
56%
37 technique(s) 64 tool(s)/malware 3 CVE(s)
ATI-Agent AdobeARM Agent.btz Agent.dne AppDomainManager Backdoors CloudSorcerer v3 Cobalt +56
T1562.001
collection
T1056 T1056.001 T1074.001 T1113 +2
command and control
T1071 T1071.001 T1102.002 T1105 +2
defense impairment
T1484.001
Victim
70%

Targeted Sectors

government defense telecommunications financial-services non-profit education think-tank energy healthcare media maritime hospitality critical-infrastructure manufacturing aerospace pharmaceutical transportation legal-services nuclear entertainment aviation chemical utilities information-technology

Targeted Countries

CN RU UA US JP IL AE PK BY IN IR VN PL KR KP LB TR TW KZ IQ DE IT SA FR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1585.003 T1588.001

Capability (Malware)

ATI-Agent AdobeARM Agent.btz
3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

ATI-Agent AdobeARM Agent.btz
4 Exploitation

Capability (Malware)

ATI-Agent AdobeARM Agent.btz
5 Installation

Capability (Techniques)

T1082 T1083 T1217

Capability (Malware)

ATI-Agent AdobeARM Agent.btz
6 Command & Control

Capability (Malware)

ATI-Agent AdobeARM Agent.btz
7 Actions on Objectives

Capability (Techniques)

T1041 T1567.002

Capability (Malware)

ATI-Agent AdobeARM Agent.btz
Leaving Threaticon

This link opens an external site that isn't part of the platform.