Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UNC6485 (threat actor)
Risk
73
High
9 techniques 49 tools/malware 40 vulnerabilities 39 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
42
T1203
Exploitation for Client Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2015-1701
CVE CVE-2017-9841
CVE CVE-2018-0171
CVE CVE-2018-1160
CVE CVE-2018-15133
CVE CVE-2018-20062
CVE CVE-2019-10744
CVE CVE-2019-18394
CVE CVE-2019-9082
CVE CVE-2020-12641
CVE CVE-2020-24363
CVE CVE-2020-35730
CVE CVE-2021-26829
CVE CVE-2021-3129
CVE CVE-2021-44026
CVE CVE-2021-44228
CVE CVE-2022-26376
CVE CVE-2022-31199
CVE CVE-2022-36327
CVE CVE-2022-42475
CVE CVE-2022-44877
CVE CVE-2022-47986
CVE CVE-2023-0669
CVE CVE-2023-20593
CVE CVE-2023-20864
CVE CVE-2023-20865
CVE CVE-2023-20887
CVE CVE-2024-1086
CVE CVE-2025-11366
CVE CVE-2025-11700
CVE CVE-2025-12480
CVE CVE-2025-20393
CVE CVE-2025-40778
CVE CVE-2025-40780
CVE CVE-2025-48703
CVE CVE-2025-60724
CVE CVE-2025-61757
CVE CVE-2025-8677
CVE CVE-2025-9316
CVE CVE-2026-50522
›
5 Installation
2
T1110.001
Password Guessing credential access
T1046
Network Service Discovery discovery
›
6 Command & Control
4
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1219
Remote Access Tools command and control
T1550.002
Pass the Hash lateral movement
›
7 Actions on Objectives
1
T1055
Process Injection stealth
Stage risk: Critical High Medium None

Tools & Malware (49)

Anchor AnyDesk Backdoors Buhtrap Cobalt Cobalt Strike (possible future use) DEADEYE Dark DarkHotel GitHub Global Hellsing Hidden Cobra Jackal Lynx Matrix Mimikatz (potentially used in lateral movements) Mirage Naikon Nexus Nitro OPENVAS Payload Poseidon Predator PuTTY Putty Rootkit Samurai Shai-Hulud Shamoon Shark Snake Spear-phishing TeamSpy Trojan Tsunami Turla VICEROY Void Zoho Assist cmd.exe gcman node.exe npm packages phishing plink sihosts.exe silcon.exe

Indicators of Compromise (39)

Domain
CommitPage.aspx GladPageUILib.GladBasePage TEMP.Zhenbao base.Request.Url url.Host string.Compare Request.Url.Host web.config +19 more
Filename
7.10368.56560.exe cmd.exe Node.js node.exe sihosts.exe silcon.exe GladinetCloudMonitor.exe GladPageUILib.dll
SHA-256 Hash
50479953865b30775056441b10fdcb984126ba4f98af4f64756902a807b453e7 16cbe40fb24ce2d422afddb5a90a5801ced32ef52c22c2fc77b25a90837f28ad
IPv4 Address
216.107.136.46 85.239.63.37

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Exploitation (5)
M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software
Installation (7)
M1027 Password Policies M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1036 Account Use Policies +2 more
Command & Control (9)
M1018 User Account Management M1026 Privileged Account Management M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic +4 more
Actions on Objectives (2)
M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint

Detection Coverage

9 strategies
4/7 stages covered

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0514 Detection Strategy for Exploitation for...

Installation (2)

DET0376 Behavioral Detection Strategy for Networ... DET0551 Password Guessing via Multi-Source Authe...

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0409 Detection Strategy for T1550.002 - Pass... DET0444 Detection of Command and Control Over Ap... DET0496 Behavior-Chain Detection for Remote Acce...

Actions on Objectives (1)

DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UNC6485

Type: Unknown Active
tracked as CVE-2025-12480 cpyy APT3 Gothic Panda +16 more
Infrastructure 29 IOC(s)
50%
Domain
CommitPage.aspx GladPageUILib.GladBasePage TEMP.Zhenbao base.Request.Url url.Host +22
IPv4 Address
216.107.136.46 85.239.63.37
Artifacts (10)
7.10368.56560.exe cmd.exe Node.js node.exe sihosts.exe silcon.exe +4
Capability
50%
9 technique(s) 49 tool(s)/malware 40 CVE(s)
Anchor AnyDesk Backdoors Buhtrap Cobalt Cobalt Strike (possible future use) DEADEYE Dark +41
command and control
T1071 T1071.001 T1219
credential access
T1110.001
discovery
T1046
execution
T1203
Victim
70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy aerospace healthcare education mining media manufacturing information-technology maritime hospitality think-tank pharmaceutical transportation chemical utilities gaming legal-services nuclear entertainment

Targeted Countries

US CN GB IN JP DE IR KR TW RU SA FR CA AU AE IL TR KZ PK VN UA PL SG NL BR ES IQ BY KP IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1203 T1068

Capability (Malware)

Anchor AnyDesk Backdoors
5 Installation

Capability (Techniques)

T1110.001 T1046

Capability (Malware)

Anchor AnyDesk Backdoors
6 Command & Control

Capability (Malware)

Anchor AnyDesk Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.