Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
DarkGaboon (threat actor)
Risk
80
Critical
14 techniques 63 tools/malware 31 vulnerabilities 39 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
4
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
35
T1047
Windows Management Instrumentation execution
T1053.006
Systemd Timers execution
T1059.001
PowerShell execution
T1203
Exploitation for Client Execution execution
CVE CVE-2010-11023
CVE CVE-2012-0158
CVE CVE-2013-4786
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2018-6065
CVE CVE-2021-26084
CVE CVE-2021-31207
CVE CVE-2021-34473
CVE CVE-2021-34523
CVE CVE-2022-26318
CVE CVE-2023-22518
CVE CVE-2023-27532
CVE CVE-2023-38950
CVE CVE-2023-38951
CVE CVE-2023-38952
CVE CVE-2024-11182
CVE CVE-2024-3721
CVE CVE-2024-40711
CVE CVE-2024-40766
CVE CVE-2024-46982
CVE CVE-2024-53704
CVE CVE-2024-8190
CVE CVE-2024-8963
CVE CVE-2024-9379
CVE CVE-2024-9380
CVE CVE-2025-21298
CVE CVE-2025-23006
CVE CVE-2025-33053
CVE CVE-2025-44277
CVE CVE-2025-44288
›
5 Installation
No data
›
6 Command & Control
1
T1021
Remote Services lateral movement
›
7 Actions on Objectives
5
T1485
Data Destruction impact
T1490
Inhibit System Recovery impact
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1055
Process Injection stealth
Stage risk: Critical High Medium None

Tools & Malware (63)

.NET Reactor Akira Anubis AnyDesk Auto-Color Linux backdoor BADAUDIO Babuk Backdoors BrokeDoor ClickFix Cobalt Cobalt Strike Dark DarkGate DarkHotel Elise (Trensil) Embe FRP (Fast Reverse Proxy) GalaxyGato GitHub Global GoRed Havex RAT KrustyLoader Legitimate Software LockBit LockBit 3.0 LockBit ransomware MeshCentral Agent More Eggs MuddyWater Mythic Ngrok OilRig Owowa PathWiper Payload Payload PhantomCore PhantomVAI Phishing emails Plink PowerShell Red Likho Remcos SDelete Sednit ShadowPad Sharp7Extend Sliver implants SocGholish Spear-phishing Spear-phishing emails SysBC Telegram Themida Trojan UNC1549 Unknown Void Web Shells ZEROLOT phishing

Indicators of Compromise (39)

Domain
mail.ru BI.ZONE Zagrebator.Dropper kzst45.ru mysterykamchatka.ru PhantomeCore.GreqBackdoor SpyPress.HORDE SpyPress.MDAEMON +5 more
Email Address
ics-cert@kaspersky.com
Filename
VALIDATOR.msi conditions.rar Document.hta pdf.scr pdf.exe xsl.scr xlsx.scr fsutil.exe +17 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (11)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +6 more
Command & Control (6)
M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program +1 more
Actions on Objectives (12)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +7 more

Detection Coverage

14 strategies
4/7 stages covered

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0231 Behavioral Detection of Systemd Timer Ab... DET0287 Exploitation for Client Execution – cros... DET0364 Behavioral Detection Strategy for WMI Ex... DET0455 Abuse of PowerShell for Arbitrary Execut...

Command & Control (1)

DET0269 Behavioral Detection Strategy for Remote...

Actions on Objectives (5)

DET0127 Behavioral Detection of Masquerading Acr... DET0146 Detection of Data Destruction Across Pla... DET0329 Behavioral Detection for T1490 - Inhibit... DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

DarkGaboon

Type: Unknown Active
Vengeful Wolf room155 APT28 Fancy Bear Storm-0978 +57 more
Infrastructure 13 IOC(s)
50%
Domain
mail.ru BI.ZONE Zagrebator.Dropper kzst45.ru mysterykamchatka.ru +8
Artifacts (26)
ics-cert@kaspersky.com VALIDATOR.msi conditions.rar Document.hta pdf.scr pdf.exe +20
Capability
50%
14 technique(s) 63 tool(s)/malware 31 CVE(s)
.NET Reactor Akira Anubis AnyDesk Auto-Color Linux backdoor BADAUDIO Babuk Backdoors +55
execution
T1047 T1053.006 T1059.001 T1203
impact
T1485 T1490
initial access
T1190 T1566 T1566.001 T1566.002
lateral movement
T1021
Victim
70%

Targeted Sectors

financial-services defense government energy transportation manufacturing telecommunications critical-infrastructure education retail aerospace media construction healthcare utilities food-agriculture aviation oil-gas pharmaceutical chemical maritime nuclear non-profit information-technology entertainment gaming

Targeted Countries

RU US CN UA TW IL KR CA TR IN BR AE BY IR JP VN SA AU EG FR GB DE MX

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Malware)

.NET Reactor Akira Anubis
4 Exploitation

Capability (Malware)

.NET Reactor Akira Anubis
6 Command & Control

Capability (Techniques)

T1021

Capability (Malware)

.NET Reactor Akira Anubis
7 Actions on Objectives

Capability (Techniques)

T1485 T1490

Capability (Malware)

.NET Reactor Akira Anubis
Leaving Threaticon

This link opens an external site that isn't part of the platform.