Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

UAT-6382 (threat actor)
Risk
71
High
7 techniques 47 tools/malware 26 vulnerabilities 39 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
2 Weaponization
No data
3 Delivery
1
5 Installation
No data
6 Command & Control
3
T1074
Data Staged collection
T1105
Ingress Tool Transfer command and control
T1021
Remote Services lateral movement
7 Actions on Objectives
2
Stage risk: Critical High Medium None

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UAT-6382

Type: Unknown Active
VShell tracked as Silence.Downloader pULB113
Capability
50%
7 technique(s) 47 tool(s)/malware 26 CVE(s)
collection
command and control
execution
Victim
70%

Targeted Sectors

government critical-infrastructure financial-services energy manufacturing mining transportation healthcare nuclear food-agriculture chemical

Targeted Countries

US UA CN RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

Capability (Malware)

Infrastructure

4 Exploitation

Capability (Techniques)

Capability (Malware)

Infrastructure

6 Command & Control

Capability (Techniques)

Capability (Malware)

Infrastructure

Leaving Threaticon

This link opens an external site that isn't part of the platform.