Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
DarkPink (threat actor)
Risk
100
Critical
42 techniques 42 tools/malware 6 vulnerabilities 39 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
2
T1583
Acquire Infrastructure resource development
T1650
Acquire Access resource development
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
›
4 Exploitation
9
T1059
Command and Scripting Interpreter execution
T1651
Cloud Administration Command execution
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2022-23521
CVE CVE-2022-27596
CVE CVE-2022-31704
CVE CVE-2022-31706
CVE CVE-2022-41903
CVE CVE-2022-41953
›
5 Installation
14
T1110
Brute Force credential access
T1557
Adversary-in-the-Middle credential access
T1010
Application Window Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1217
Browser Information Discovery discovery
T1580
Cloud Infrastructure Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1098
Account Manipulation persistence
T1133
External Remote Services persistence
T1547
Boot or Logon Autostart Execution persistence
T1671
Cloud Application Integration persistence
›
6 Command & Control
7
T1115
Clipboard Data collection
T1119
Automated Collection collection
T1123
Audio Capture collection
T1185
Browser Session Hijacking collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
T1071.003
Mail Protocols command and control
›
7 Actions on Objectives
13
T1020
Automated Exfiltration exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1531
Account Access Removal impact
T1657
Financial Theft impact
T1027
Obfuscated Files or Information stealth
T1027.002
Software Packing stealth
T1134
Access Token Manipulation stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1197
BITS Jobs stealth
T1612
Build Image on Host stealth
T1620
Reflective Code Loading stealth
Stage risk: Critical High Medium None

Tools & Malware (42)

Akira BITS Backdoors BlackByte Cobalt Conti Custom Tools Custom malware Custom tools Dark GitHub Global Group Policy Hive KamiKakaBot Kimsuky Leverage LockBit Lynx MuddyWater Mythic PLAY Payload Phishing campaigns Phishing emails Pink PowerShell PowerSploit Remote access tools Royal Spear-phishing Spear-phishing emails TelePowerBot Telegram Trojan Tsunami Unknown Void WhatsApp Winnti inter phishing

Indicators of Compromise (39)

Domain
Darkpick.com System.Net.Http.StringContent System.IO.File System.Net.Http.ByteArrayContent Content.Length byte.Headers.Add ascii.getstring ascii.getbytes +19 more
Email Address
blackpink.301@outlook.com blackred.113@outlook.com
Filename
file.zip Dism.sys system.bat explorer.exe cmd.exe user32.dll mpnotify.exe notepad.exe +2 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

32 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (14)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more
Exploitation (14)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +9 more
Installation (17)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +12 more
Command & Control (7)
M1017 User Training M1018 User Account Management M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic +2 more
Actions on Objectives (15)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +10 more

Detection Coverage

42 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (2)

DET0884 Detection of Acquire Access DET0895 Detection of Acquire Infrastructure

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult...

Exploitation (3)

DET0345 Detection Strategy for Abuse Elevation C... DET0516 Behavioral Detection of Command and Scri... DET0545 Detection Strategy for Cloud Administrat...

Installation (14)

DET0013 Detection of Local Browser Artifact Acce... DET0034 Detection of Adversarial Process Discove... DET0096 Account Manipulation Behavior Chain Dete... DET0097 Detection of Application Window Enumerat... DET0112 Boot or Logon Initialization Scripts Det... +9 more

Command & Control (7)

DET0135 Detection of Mail Protocol-Based C2 Acti... DET0186 Automated File and API Collection Detect... DET0221 Behavioral Detection Strategy for T1123... DET0341 Clipboard Data Access with Anomalous Con... DET0444 Detection of Command and Control Over Ap... +2 more

Actions on Objectives (13)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0098 Detect abuse of Windows BITS Jobs for do... DET0120 Account Access Removal via Multi-Platfor... DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

DarkPink

Type: Unknown Active
Saaiwc tracked as Sandworm Team Operation Cleaver Shell Crew +32 more
Infrastructure 27 IOC(s)
50%
Domain
Darkpick.com System.Net.Http.StringContent System.IO.File System.Net.Http.ByteArrayContent Content.Length +22
Artifacts (12)
blackpink.301@outlook.com blackred.113@outlook.com file.zip Dism.sys system.bat explorer.exe +6
Capability
50%
42 technique(s) 42 tool(s)/malware 6 CVE(s)
Akira BITS Backdoors BlackByte Cobalt Conti Custom Tools Custom malware +34
collection
T1115 T1119 T1123 T1185 +1
command and control
T1071 T1071.003
credential access
T1110 T1557
discovery
T1010 T1057 T1082 T1083 +3
Victim
70%

Targeted Sectors

government defense financial-services telecommunications healthcare education media manufacturing non-profit critical-infrastructure energy retail information-technology aviation hospitality pharmaceutical aerospace transportation think-tank gaming maritime mining chemical legal-services nuclear construction entertainment oil-gas utilities food-agriculture

Targeted Countries

US CN RU UA VN GB IR DE PL IL AU IN PK JP TW ES KP SA FR AE SG BY KR CA TR MX NL RO NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

Akira BITS Backdoors
2 Weaponization

Capability (Techniques)

T1583 T1650

Capability (Malware)

Akira BITS Backdoors
3 Delivery

Capability (Techniques)

T1190 T1566

Capability (Malware)

Akira BITS Backdoors
4 Exploitation

Capability (Techniques)

T1059 T1651 T1548

Capability (Malware)

Akira BITS Backdoors
5 Installation

Capability (Malware)

Akira BITS Backdoors
6 Command & Control

Capability (Malware)

Akira BITS Backdoors
7 Actions on Objectives

Capability (Malware)

Akira BITS Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.