Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
BatShadow (threat actor)
Risk
78
Critical
20 techniques 43 tools/malware 1 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
2
T1059.003
Windows Command Shell execution
CVE CVE-2026-50522
›
5 Installation
7
T1003
OS Credential Dumping credential access
T1040
Network Sniffing credential access
T1110
Brute Force credential access
T1018
Remote System Discovery discovery
T1083
File and Directory Discovery discovery
T1124
System Time Discovery discovery
T1133
External Remote Services persistence
›
6 Command & Control
3
T1602
Data from Configuration Repository collection
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
7
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
T1055
Process Injection stealth
T1060
T1060
T1520
T1520
Stage risk: Critical High Medium None

Tools & Malware (43)

Agent Tesla BlackCat BlackSuit CHINACHOPPER Cobalt Cobalt Strike Conti Dark Emotet GitHub Global HELLOKITTY Hive LaZagne Leverage LockBit Lumma Stealer Lynx Malicious files Mimikatz Mythic Nokoyawa Ransomware Phishing campaigns Phishing emails Phobos PowerShell Ransomware variants Royal Royal Ransomware ShadowPad Social engineering tactics TONESHELL Telegram Trigona Trojan Unknown Vampire Bot Venom RAT Visual Studio Code WhatsApp WildFire nuclei phishing

Indicators of Compromise (39)

Domain
TEMP.Hex NTDS.dit demo-cloud.space Temp.Zagros TEMP.Akapav TEMP.Jumper TEMP.Periscope
Filename
update.exe rar.exe sshd.exe pdf.exe code.exe Listeners.bat batshadow-vietnamese-threat-group-vampire-bot-report.pdf Sshd.exe +9 more
SHA-256 Hash
965dd0b255f05ff012d2f152e973e09ceb9e95b6239dc820c8ac4d4492255472 506fc87c8c96fef1d2df24b0ba44c8116a9001ca5a7d7e9c01dc3940a664acb0 aa2c0de121ae738ce44727456d97434faff21fc69219e964e1e2d2f1ca16b1c5 8fdac78183ff18de0c07b10e8d787326691d7fb1f63b3383471312b74918c39f 39ceb73bcfd1f674a9b72a03476a9de997867353172c2bf6dde981c5b3ad512a fb0c4db0011ee19742d7d8bd0558d8ee8be2ef23c4c61a3e80a34fba6c96f3ff acedfe9c662c2666787cbbf8d3a0225863bab2c239777594b003381244ed81ba 0f11b6dd8ff972a2f8cb7798b1a0a8cd10afadcea201541c93ef0ab9b141c184 +5 more
IPv4 Address
103.124.95.161 216.83.40.84

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (1)
M1038 Execution Prevention
Installation (16)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1025 Privileged Process Integrity +11 more
Command & Control (6)
M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information M1051 Update Software +1 more
Actions on Objectives (11)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +6 more

Detection Coverage

18 strategies
5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Installation (7)

DET0151 Behavior-chain, platform-aware detection... DET0234 Credential Dumping via Sensitive Memory... DET0314 Detection Strategy for Network Sniffing... DET0354 Behavior-chain detection for T1133 Exter... DET0370 Recursive Enumeration of Files and Direc... +2 more

Command & Control (3)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0592 Detection Strategy for Data from Configu...

Actions on Objectives (5)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft DET0508 Behavioral Detection of Process Injectio... DET0548 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

BatShadow

Type: Unknown Active
said tracked as expert insights intelligence updates BlackCat +12 more
Infrastructure 9 IOC(s)
50%
Domain
TEMP.Hex NTDS.dit demo-cloud.space Temp.Zagros TEMP.Akapav +2
IPv4 Address
103.124.95.161 216.83.40.84
Artifacts (30)
update.exe rar.exe sshd.exe pdf.exe code.exe Listeners.bat +24
Capability
50%
20 technique(s) 43 tool(s)/malware 1 CVE(s)
Agent Tesla BlackCat BlackSuit CHINACHOPPER Cobalt Cobalt Strike Conti Dark +35
T1060 T1520
collection
T1602
command and control
T1071.001 T1105
credential access
T1003 T1040 T1110
Victim
70%

Targeted Sectors

government financial-services education telecommunications defense critical-infrastructure healthcare manufacturing media retail non-profit information-technology hospitality aerospace maritime nuclear entertainment gaming food-agriculture construction transportation energy

Targeted Countries

KP CN RU IN UA GB DE IR PK BY PL TW CA AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Agent Tesla BlackCat BlackSuit
4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

Agent Tesla BlackCat BlackSuit
5 Installation

Capability (Malware)

Agent Tesla BlackCat BlackSuit
6 Command & Control

Capability (Techniques)

T1602 T1071.001 T1105

Capability (Malware)

Agent Tesla BlackCat BlackSuit
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

Agent Tesla BlackCat BlackSuit
Leaving Threaticon

This link opens an external site that isn't part of the platform.