Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

ShadyPanda (threat actor)
Risk
76
Critical
22 techniques 45 tools/malware 0 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
2 Weaponization
No data
3 Delivery
1
T1566.001
4 Exploitation
5
T1059.003
T1059.007
JavaScript execution
T1546
Event Triggered Execution privilege escalation
5 Installation
9
T1555.003
T1557
Adversary-in-the-Middle credential access
T1057
T1087
T1176
T1176.001
T1176.002
IDE Extensions persistence
T1505
6 Command & Control
4
T1113
Screen Capture collection
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
T1021
Remote Services lateral movement
7 Actions on Objectives
3
Stage risk: Critical High Medium None

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

ShadyPanda

Type: Unknown Active
tracked as Shell Crew WebMasters KungFu Kittens PinkPanther
Capability
50%
22 technique(s) 45 tool(s)/malware
collection
command and control
credential access
discovery
Victim
70%

Targeted Sectors

financial-services government critical-infrastructure manufacturing telecommunications defense healthcare think-tank retail

Targeted Countries

US IN ES CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

Capability (Malware)

4 Exploitation
5 Installation
6 Command & Control
Leaving Threaticon

This link opens an external site that isn't part of the platform.