Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
GreedyBear (threat actor)
Risk
71
High
11 techniques 64 tools/malware 2 vulnerabilities 37 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
5
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1195
Supply Chain Compromise initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
3
T1204
User Execution execution
CVE CVE-2022-30190
CVE CVE-2023-23397
›
5 Installation
1
T1555.003
Credentials from Web Browsers credential access
›
6 Command & Control
1
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
3
T1041
Exfiltration Over C2 Channel exfiltration
T1027
Obfuscated Files or Information stealth
T1086
T1086
Stage risk: Critical High Medium None

Tools & Malware (64)

APT38 ATI-Agent AdobeARM Agent.btz Agent.dne Astaroth CHOPSTICK Chaos ClickFix Cobalt Credential stealers CredoMap Double Dragon DownRange Emotet Emotet Exodus Expand Firefox Foozer Gazer Ghost RAT GitHub GlassWorm Global Globe Guard Havex RAT Leverage LummaStealer Microsoft Teams MiniDionis Nautilus Net Neuron OilRig Phishing campaigns Phishing emails PlugX Ransomware variants STOP SUNBURST Sednit Sofacy SolarWinds Spear-phishing Spear-phishing emails Systeminfo Tasklist Tavdig Telegram Trojan Turla Unknown Uroburos WhiteBear WinIDS Wipbot XAgent X‑Tunnel gpresult phishing pwdump wce

Indicators of Compromise (37)

Domain
portswigger.net secure-wallets.co.com connects.co.com tweser.io snipersol.com upholdassets.com marshallcenter.org esquire.com +23 more
Email Address
Info@rescana.com ops@rescana.com hello@koi.ai
Filename
Threat.rtf
IPv4 Address
185.208.156.66 185.39.206.135

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (18)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +13 more
Exploitation (6)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +1 more
Installation (5)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1051 Update Software
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (6)
M1017 User Training M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1047 Audit M1049 Antivirus/Antimalware +1 more

Detection Coverage

10 strategies
5/7 stages covered

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (1)

DET0478 User Execution – multi-surface behavior...

Installation (1)

DET0037 Detect Suspicious Access to Browser Cred...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (2)

DET0348 Detection Strategy for Exfiltration Over... DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

GreedyBear

Type: Unknown Active
APT28 tracked as Pawn Storm Fancy Bear Sednit +32 more
Infrastructure 33 IOC(s)
50%
Domain
portswigger.net secure-wallets.co.com connects.co.com tweser.io snipersol.com +26
IPv4 Address
185.208.156.66 185.39.206.135
Artifacts (4)
Info@rescana.com ops@rescana.com hello@koi.ai Threat.rtf
Capability
56%
11 technique(s) 64 tool(s)/malware 2 CVE(s)
APT38 ATI-Agent AdobeARM Agent.btz Agent.dne Astaroth CHOPSTICK Chaos +56
T1086
command and control
T1105
credential access
T1555.003
execution
T1204
Victim
70%

Targeted Sectors

government defense financial-services media energy pharmaceutical manufacturing aerospace non-profit aviation critical-infrastructure chemical nuclear

Targeted Countries

RU UA US CN NL FR GB BY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Malware)

APT38 ATI-Agent AdobeARM
4 Exploitation

Capability (Techniques)

T1204

Capability (Malware)

APT38 ATI-Agent AdobeARM
5 Installation

Capability (Techniques)

T1555.003

Capability (Malware)

APT38 ATI-Agent AdobeARM
6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

APT38 ATI-Agent AdobeARM
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

APT38 ATI-Agent AdobeARM
Leaving Threaticon

This link opens an external site that isn't part of the platform.