Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UNC5342 (threat actor)
Risk
100
Critical
40 techniques 42 tools/malware 12 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1589
Gather Victim Identity Information reconnaissance
T1595
Active Scanning reconnaissance
›
2 Weaponization
5
T1583
Acquire Infrastructure resource development
T1584
Compromise Infrastructure resource development
T1585
Establish Accounts resource development
T1586
Compromise Accounts resource development
T1587
Develop Capabilities resource development
›
3 Delivery
2
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
19
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1203
Exploitation for Client Execution execution
T1559
Inter-Process Communication execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1546
Event Triggered Execution privilege escalation
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2017-8759
CVE CVE-2022-38028
CVE CVE-2023-48022
CVE CVE-2024-3400
CVE CVE-2024-39717
CVE CVE-2025-49704
CVE CVE-2025-49706
CVE CVE-2025-53770
CVE CVE-2025-53771
CVE CVE-2025-55182
›
5 Installation
6
T1111
Multi-Factor Authentication Interception credential access
T1212
Exploitation for Credential Access credential access
T1482
Domain Trust Discovery discovery
T1615
Group Policy Discovery discovery
T1133
External Remote Services persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
8
T1056
Input Capture collection
T1074
Data Staged collection
T1213
Data from Information Repositories collection
T1560
Archive Collected Data collection
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
T1219.002
Remote Desktop Software command and control
T1534
Internal Spearphishing lateral movement
›
7 Actions on Objectives
10
T1686
Disable or Modify System Firewall defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1489
Service Stop impact
T1490
Inhibit System Recovery impact
T1070.004
File Deletion stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1197
BITS Jobs stealth
T1218.005
Mshta stealth
Stage risk: Critical High Medium None

Tools & Malware (42)

AnyDesk BITS Backdoors BeaverTail ClearFake ClickFix Cobalt Cobalt Strike Dark EtherRAT Expand Explorer FrostyGoop FunnyDream GitHub Global Group Policy Infostealer Interception InvisibleFerret JADESNOW Leverage Mango Nexus Payload Payload Pikabot PowerShell STOP SolarWinds Triton Trojan Unknown Vidar Web Shell Web Shells WildFire Windows Command Shell YARA mshta npm packages phishing

Indicators of Compromise (40)

Domain
ratatui.today saaadnesss.shop pako.ungzip console.log web3.eth.Contract Mallory.ai Crypto.com INVISIBLEFERRET.JAVASCRIPT +11 more
Filename
MiroTalk.msi svhost.exe python.exe
SHA-256 Hash
000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3 3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612 c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c be1037fac396cf54fb9e25c48e5b0039b3911bb8426cbf52c9433ba06c0685ce 970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628 01fd153bfb4be440dd46cea7bebe8eb61b1897596523f6f6d1a507a708b17cc7
IPv4 Address
95.164.17.24 138.226.236.51 83.217.208.130 80.64.30.238 94.74.164.207
URL
http://nmsneustadtl.ac.at/xml.php http://envisionreg.com/wp-activate.php http://tracklist22.pages.dev/ http://sdfwefwg.pages.dev/ http:///prrq.php http://biggoalsports.co.za/minif.php

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

31 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (10)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +5 more
Exploitation (15)
M1013 Application Developer Guidance M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation +10 more
Installation (12)
M1013 Application Developer Guidance M1017 User Training M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1030 Network Segmentation +7 more
Command & Control (11)
M1017 User Training M1018 User Account Management M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic +6 more
Actions on Objectives (15)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1028 Operating System Configuration +10 more

Detection Coverage

40 strategies
7/7 stages covered

Reconnaissance (2)

DET0830 Detection of Active Scanning DET0841 Detection of Gather Victim Identity Info...

Weaponization (5)

DET0853 Detection of Develop Capabilities DET0873 Detection of Establish Accounts DET0876 Detection of Compromise Accounts DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (7)

DET0010 Behavioral Detection of Event Triggered... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0493 Detect Abuse of Inter-Process Communicat... +2 more

Installation (6)

DET0007 Detection of Domain Trust Discovery via... DET0055 Detection strategy for Group Policy Disc... DET0174 Detection Strategy for Exploitation for... DET0246 Detection Strategy for MFA Interception... DET0274 Boot or Logon Autostart Execution Detect... +1 more

Command & Control (8)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0054 Internal Spearphishing via Trusted Accou... DET0060 Detect Ingress Tool Transfers via Behavi... DET0102 Behavioral Detection of Input Capture Ac... +3 more

Actions on Objectives (10)

DET0021 Behavioral Detection for Service Stop ac... DET0098 Detect abuse of Windows BITS Jobs for do... DET0140 Behavioral Detection of Malicious File D... DET0145 Detection of Disabled or Modified System... DET0215 Detection of Multi-Platform File Encrypt... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UNC5342

Type: Unknown Active
tracked as CVE-2025-55182 STATIC TUNDRA also tracked as Sandwo CovertNetwork-1658 +10 more
Infrastructure 30 IOC(s)
50%
Domain
ratatui.today saaadnesss.shop pako.ungzip console.log web3.eth.Contract +14
IPv4 Address
95.164.17.24 138.226.236.51 83.217.208.130 80.64.30.238 94.74.164.207
URL
http://nmsneustadtl.ac.at/xml.php http://envisionreg.com/wp-activate.php http://tracklist22.pages.dev/ http://sdfwefwg.pages.dev/ http:///prrq.php +1
Artifacts (10)
MiroTalk.msi svhost.exe python.exe 000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3 3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612 +4
Capability
50%
40 technique(s) 42 tool(s)/malware 12 CVE(s)
AnyDesk BITS Backdoors BeaverTail ClearFake ClickFix Cobalt Cobalt Strike +34
collection
T1056 T1074 T1213 T1560
command and control
T1071.001 T1105 T1219.002
credential access
T1111 T1212
defense impairment
T1686
Victim
70%

Targeted Sectors

financial-services government energy defense healthcare manufacturing maritime telecommunications information-technology critical-infrastructure aerospace transportation media aviation education chemical think-tank construction oil-gas hospitality non-profit nuclear legal-services

Targeted Countries

KP CN US UA IN JP AU CA IR KR GB PL SG VN TW RU DE KZ IL TR FR BR MX ES IT

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1595

Capability (Malware)

AnyDesk BITS Backdoors
2 Weaponization

Capability (Malware)

AnyDesk BITS Backdoors
3 Delivery

Capability (Techniques)

T1189 T1190

Capability (Malware)

AnyDesk BITS Backdoors
4 Exploitation

Capability (Malware)

AnyDesk BITS Backdoors
5 Installation

Capability (Malware)

AnyDesk BITS Backdoors
6 Command & Control

Capability (Malware)

AnyDesk BITS Backdoors
7 Actions on Objectives

Capability (Malware)

AnyDesk BITS Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.