Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UAT-8837 (threat actor)
Risk
91
Critical
42 techniques 58 tools/malware 13 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
4
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
23
T1053
Scheduled Task/Job execution
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1106
Native API execution
T1203
Exploitation for Client Execution execution
T1204
User Execution execution
T1204.002
Malicious File execution
T1559
Inter-Process Communication execution
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2016-4117
CVE CVE-2017-0199
CVE CVE-2018-4878
CVE CVE-2020-1380
CVE CVE-2020-26411
CVE CVE-2021-26411
CVE CVE-2024-2617
CVE CVE-2025-4427
CVE CVE-2025-4428
CVE CVE-2025-53690
CVE CVE-2025-53770
CVE CVE-2026-21509
CVE CVE-2026-21513
›
5 Installation
10
T1003
OS Credential Dumping credential access
T1555
Credentials from Password Stores credential access
T1033
System Owner/User Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1087.002
Domain Account discovery
T1120
Peripheral Device Discovery discovery
T1136
Create Account persistence
T1547
Boot or Logon Autostart Execution persistence
T1547.003
Time Providers persistence
›
6 Command & Control
6
T1005
Data from Local System collection
T1123
Audio Capture collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1102
Web Service command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
12
T1112
Modify Registry defense impairment
T1048
Exfiltration Over Alternative Protocol exfiltration
T1485
Data Destruction impact
T1529
System Shutdown/Reboot impact
T1561
Disk Wipe impact
T1014
Rootkit stealth
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1055
Process Injection stealth
T1078
Valid Accounts stealth
T1574.006
Dynamic Linker Hijacking stealth
T1081
T1081
Stage risk: Critical High Medium None

Tools & Malware (58)

AppDomainManager BITS Babuk Backdoors Certipy Cobalt Cobalt Strike Cobint CovenantGrunt DWAgent DynoWiper Earthworm GoExec Group Policy Handala Hook Hydra Hydra Saiga Impacket Interception LockBit MSBuild Matrix MiniDoor MuddyWater NET-STAR Nexus Open-source tools PUMAKIT Payload Payload PhantomCore PhantomHeart PhantomProxyLite PhantomPxPigeon Phishing emails PixyNetLoader PowerShell PrismexDrop PrismexLoader PrismexSheet PrismexStager Process Hollowing Rootkit Rubeus SharpHound Sharphound Spear-phishing Spear-phishing emails Telegram Unknown Web Shell WildFire Windows Command Shell dsquery netsh phishing systemd

Indicators of Compromise (39)

Domain
demo-cloud.space outbreak.Find events.Develop protection.Identify TEMP.Reaper OutlookEN.aspx 10.xx.xx.xx goe.ico +13 more
Filename
twd.exe lsass.exe SharpHound.exe goe.exe dsget.exe aa.exe cmd.exe w3wp.exe +5 more
MD5 Hash
00000000000000000000000000000000
IPv4 Address
4.144.1.47 74.176.166.174 20.200.129.75 172.188.162.183

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (20)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +15 more
Installation (14)
M1015 Active Directory Configuration M1017 User Training M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1025 Privileged Process Integrity +9 more
Command & Control (4)
M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1057 Data Loss Prevention
Actions on Objectives (21)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +16 more

Detection Coverage

41 strategies
5/7 stages covered

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (10)

DET0094 Cross-Platform Behavioral Detection of S... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0345 Detection Strategy for Abuse Elevation C... DET0441 Detection of Suspicious Scheduled Task C... +5 more

Installation (10)

DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0122 Detect Abuse of Windows Time Providers f... DET0129 Domain Account Enumeration Across Platfo... DET0234 Credential Dumping via Sensitive Memory... +5 more

Command & Control (6)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0221 Behavioral Detection Strategy for T1123... DET0380 Detection of Local Data Collection Prior... DET0425 Suspicious Use of Web Services for C2 +1 more

Actions on Objectives (11)

DET0127 Behavioral Detection of Masquerading Acr... DET0131 Behavioral Detection Strategy for Exfilt... DET0137 Detection Strategy for Disk Wipe via Dir... DET0146 Detection of Data Destruction Across Pla... DET0280 Behavior-Based Registry Modification Det... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UAT-8837

Type: Unknown Active
APT28 tracked as Head Mare 21 2026 +53 more
Infrastructure 25 IOC(s)
50%
Domain
demo-cloud.space outbreak.Find events.Develop protection.Identify TEMP.Reaper +16
IPv4 Address
4.144.1.47 74.176.166.174 20.200.129.75 172.188.162.183
Artifacts (14)
twd.exe lsass.exe SharpHound.exe goe.exe dsget.exe aa.exe +8
Capability
50%
42 technique(s) 58 tool(s)/malware 13 CVE(s)
AppDomainManager BITS Babuk Backdoors Certipy Cobalt Cobalt Strike Cobint +50
T1081
collection
T1005 T1123
command and control
T1071 T1071.001 T1102 T1105
credential access
T1003 T1555
Victim
70%

Targeted Sectors

critical-infrastructure government financial-services energy manufacturing transportation defense telecommunications education construction maritime aerospace healthcare retail aviation non-profit utilities chemical nuclear media mining pharmaceutical

Targeted Countries

CN RU US PL AE RO KZ UA BR IL KR IN TR PK GB VN JP KP BY NG SA MX ES IT DE NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Malware)

AppDomainManager BITS Babuk
4 Exploitation

Capability (Malware)

AppDomainManager BITS Babuk
5 Installation

Capability (Malware)

AppDomainManager BITS Babuk
6 Command & Control

Capability (Malware)

AppDomainManager BITS Babuk
7 Actions on Objectives

Capability (Techniques)

T1048 T1485 T1529 T1561

Capability (Malware)

AppDomainManager BITS Babuk
Leaving Threaticon

This link opens an external site that isn't part of the platform.