Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
DarkSpectre (threat actor)
Risk
100
Critical
42 techniques 42 tools/malware 10 vulnerabilities 38 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
2
T1583
Acquire Infrastructure resource development
T1650
Acquire Access resource development
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
›
4 Exploitation
13
T1059
Command and Scripting Interpreter execution
T1651
Cloud Administration Command execution
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2020-12812
CVE CVE-2021-26855
CVE CVE-2021-34473
CVE CVE-2025-14174
CVE CVE-2025-43529
CVE CVE-2025-55182
CVE CVE-2025-59718
CVE CVE-2025-59719
CVE CVE-2026-35273
CVE CVE-2026-43503
›
5 Installation
15
T1110
Brute Force credential access
T1557
Adversary-in-the-Middle credential access
T1010
Application Window Discovery discovery
T1087
Account Discovery discovery
T1217
Browser Information Discovery discovery
T1526
Cloud Service Discovery discovery
T1538
Cloud Service Dashboard discovery
T1580
Cloud Infrastructure Discovery discovery
T1619
Cloud Storage Object Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1098
Account Manipulation persistence
T1133
External Remote Services persistence
T1176
Software Extensions persistence
T1547
Boot or Logon Autostart Execution persistence
T1671
Cloud Application Integration persistence
›
6 Command & Control
6
T1115
Clipboard Data collection
T1119
Automated Collection collection
T1123
Audio Capture collection
T1185
Browser Session Hijacking collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
›
7 Actions on Objectives
13
T1556
Modify Authentication Process defense impairment
T1020
Automated Exfiltration exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1499
Endpoint Denial of Service impact
T1531
Account Access Removal impact
T1657
Financial Theft impact
T1027
Obfuscated Files or Information stealth
T1134
Access Token Manipulation stealth
T1197
BITS Jobs stealth
T1612
Build Image on Host stealth
T1048.004
T1048.004
Stage risk: Critical High Medium None

Tools & Malware (42)

BITS Backdoors BlackSuit Cobalt Conti Dark Firefox Gh0st GitHub Global Group Policy Guard Hook Leverage LockBit Lynx MailSniper Malwarebytes Mythic Nexus Ninja Payload Payload PlugX PowerShell Royal SUNBURST Specter SweetSpecter TunnelSpecter Unknown Web Shell Web Shells WildFire Windows Command Shell Yasso ZLib gh0st RAT inter netsh phishing systemd

Indicators of Compromise (38)

Domain
safer.ddns.us Mallory.ai logo.png microsoft-ns1.com ManagementMailboxPicker.aspx Reaktr.ai home.microsoft-ns1.com cloud.microsoft-ns1.com +8 more
Filename
Tpwinprn.dll svchost.exe spoolsv.exe user32.dll mpnotify.exe rundll32.exe
SHA-256 Hash
8198c8b5eaf43b726594df62127bcb1a4e0e46cf5cb9fa170b8d4ac2a4dad179 0f72e9eb5201b984d8926887694111ed09f28c87261df7aab663f5dc493e215f d5a44380e4f7c1096b1dddb6366713aa8ecb76ef36f19079087fc76567588977 3d74df40e3d2730941ff64f275217ae6d46b20d7fbbd04123bc156daf8f6e85c 0e0b5c5c5d569e2ac8b70ace920c9f483f8d25aae7769583a721b202bcc0778f 62dec3fd2cdbc1374ec102d027f09423aa2affe1fb40ca05bf742f249ad7eb51 22d556db39bde212e6dbaa154e9bcf57527e7f51fa2f8f7a60f6d7109b94048e 0b980e7a5dd5df0d6f07aabd6e7e9fc2e3c9e156ef8c0a62a0e20cd23c333373
IPv4 Address
192.225.226.217 103.108.192.238 103.149.90.235 194.14.217.34 103.108.67.153 27.255.79.17 192.225.226.196 108.61.178.125

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (14)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more
Exploitation (14)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +9 more
Installation (20)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +15 more
Command & Control (7)
M1017 User Training M1018 User Account Management M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic +2 more
Actions on Objectives (19)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +14 more

Detection Coverage

41 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (2)

DET0884 Detection of Acquire Access DET0895 Detection of Acquire Infrastructure

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult...

Exploitation (3)

DET0345 Detection Strategy for Abuse Elevation C... DET0516 Behavioral Detection of Command and Scri... DET0545 Detection Strategy for Cloud Administrat...

Installation (15)

DET0013 Detection of Local Browser Artifact Acce... DET0092 Detection of Malicious or Unauthorized S... DET0096 Account Manipulation Behavior Chain Dete... DET0097 Detection of Application Window Enumerat... DET0112 Boot or Logon Initialization Scripts Det... +10 more

Command & Control (6)

DET0186 Automated File and API Collection Detect... DET0221 Behavioral Detection Strategy for T1123... DET0341 Clipboard Data Access with Anomalous Con... DET0444 Detection of Command and Control Over Ap... DET0507 Detect browser session hijacking via pri... +1 more

Actions on Objectives (12)

DET0098 Detect abuse of Windows BITS Jobs for do... DET0104 Detect Modification of Authentication Pr... DET0120 Account Access Removal via Multi-Platfor... DET0131 Behavioral Detection Strategy for Exfilt... DET0208 Endpoint Resource Saturation and Crash P... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

DarkSpectre

Type: Unknown Active
APT27 tracked as carried out this operation Mustang Panda Winnti +19 more
Infrastructure 24 IOC(s)
50%
Domain
safer.ddns.us Mallory.ai logo.png microsoft-ns1.com ManagementMailboxPicker.aspx +11
IPv4 Address
192.225.226.217 103.108.192.238 103.149.90.235 194.14.217.34 103.108.67.153 +3
Artifacts (14)
Tpwinprn.dll svchost.exe spoolsv.exe user32.dll mpnotify.exe rundll32.exe +8
Capability
50%
42 technique(s) 42 tool(s)/malware 10 CVE(s)
BITS Backdoors BlackSuit Cobalt Conti Dark Firefox Gh0st +34
T1048.004
collection
T1115 T1119 T1123 T1185 +1
command and control
T1071
credential access
T1110 T1557
Victim
70%

Targeted Sectors

government financial-services defense telecommunications media critical-infrastructure education healthcare non-profit manufacturing information-technology retail hospitality energy aerospace maritime nuclear entertainment gaming food-agriculture construction transportation utilities

Targeted Countries

CN RU US GB DE IR UA FR IN PL IL KP EG RO PK BY TW CA AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

BITS Backdoors BlackSuit
2 Weaponization

Capability (Techniques)

T1583 T1650

Capability (Malware)

BITS Backdoors BlackSuit
3 Delivery

Capability (Techniques)

T1190 T1566

Capability (Malware)

BITS Backdoors BlackSuit
4 Exploitation

Capability (Techniques)

T1059 T1651 T1548

Capability (Malware)

BITS Backdoors BlackSuit
5 Installation

Capability (Malware)

BITS Backdoors BlackSuit
6 Command & Control

Capability (Malware)

BITS Backdoors BlackSuit
7 Actions on Objectives

Capability (Malware)

BITS Backdoors BlackSuit
Leaving Threaticon

This link opens an external site that isn't part of the platform.