Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Storm-1516 (threat actor)
Risk
100
Critical
40 techniques 41 tools/malware 13 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
3
T1583
Acquire Infrastructure resource development
T1584
Compromise Infrastructure resource development
T1586
Compromise Accounts resource development
›
3 Delivery
2
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
17
T1059
Command and Scripting Interpreter execution
T1203
Exploitation for Client Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1546
Event Triggered Execution privilege escalation
CVE CVE-2014-4076
CVE CVE-2015-1701
CVE CVE-2015-2387
CVE CVE-2015-4902
CVE CVE-2017-0262
CVE CVE-2017-0263
CVE CVE-2022-38028
CVE CVE-2025-26399
CVE CVE-2025-40551
CVE CVE-2026-1281
CVE CVE-2026-1340
CVE CVE-2026-21509
CVE CVE-2026-22769
›
5 Installation
6
T1110
Brute Force credential access
T1552.004
Private Keys credential access
T1557
Adversary-in-the-Middle credential access
T1037
Boot or Logon Initialization Scripts persistence
T1098
Account Manipulation persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
13
T1005
Data from Local System collection
T1025
Data from Removable Media collection
T1039
Data from Network Shared Drive collection
T1074
Data Staged collection
T1114
Email Collection collection
T1119
Automated Collection collection
T1213
Data from Information Repositories collection
T1560
Archive Collected Data collection
T1001
Data Obfuscation command and control
T1071
Application Layer Protocol command and control
T1092
Communication Through Removable Media command and control
T1573
Encrypted Channel command and control
T1210
Exploitation of Remote Services lateral movement
›
7 Actions on Objectives
11
T1685
Disable or Modify Tools defense impairment
T1686
Disable or Modify System Firewall defense impairment
T1030
Data Transfer Size Limits exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1561
Disk Wipe impact
T1006
Direct Volume Access stealth
T1134
Access Token Manipulation stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1211
Exploitation for Stealth stealth
T1516
T1516
Stage risk: Critical High Medium None

Tools & Malware (41)

BARIUM BlackEnergy CHOPSTICK DarkPulsar Downdelph Erebus Forfiles Global Google Drive Imperial Kitten JHUHUGIT Koadic KryBit LAMEHUG Labyrinth Chollima LoJax Mimikatz Payload PlugX PowerShell PowerShell commands Proton Qilin Responder Rootkit Rundll32 Sednit Sofacy Trojan Tsunami Unknown Web Shell Wevtutil Windows Command Shell Winnti Winrar certutil cipher.exe netsh phishing route

Indicators of Compromise (40)

Domain
lequotidienfrancais.fr fldaily.news silvercity.news usatimes.news wval.news infofrancaisedujour.fr NTDS.dit darkpulsar.ai +27 more
Filename
rundll32.exe cmd.exe cipher.exe
IPv4 Address
89.31.82.185 72.14.185.187

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (10)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +5 more
Exploitation (13)
M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention +8 more
Installation (16)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +11 more
Command & Control (21)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1020 SSL/TLS Inspection +16 more
Actions on Objectives (19)
M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +14 more

Detection Coverage

39 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (3)

DET0876 Detection of Compromise Accounts DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (4)

DET0010 Behavioral Detection of Event Triggered... DET0287 Exploitation for Client Execution – cros... DET0514 Detection Strategy for Exploitation for... DET0516 Behavioral Detection of Command and Scri...

Installation (6)

DET0096 Account Manipulation Behavior Chain Dete... DET0112 Boot or Logon Initialization Scripts Det... DET0274 Boot or Logon Autostart Execution Detect... DET0296 Detect Adversary-in-the-Middle via Netwo... DET0463 Brute Force Authentication Failures with... +1 more

Command & Control (13)

DET0014 Detection of Data Staging Prior to Exfil... DET0053 Detect Obfuscated C2 via Network Traffic... DET0090 Cross-host C2 via Removable Media Relay DET0118 Exploitation of Remote Services – multi-... DET0186 Automated File and API Collection Detect... +8 more

Actions on Objectives (10)

DET0131 Behavioral Detection Strategy for Exfilt... DET0137 Detection Strategy for Disk Wipe via Dir... DET0145 Detection of Disabled or Modified System... DET0213 Detection Strategy for Data Transfer Siz... DET0275 Detect Adversary Deobfuscation or Decodi... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Storm-1516

Type: Unknown Active
CopyCop tracked as Sandworm Team France Canada +2 more
Infrastructure 37 IOC(s)
50%
Domain
lequotidienfrancais.fr fldaily.news silvercity.news usatimes.news wval.news +30
IPv4 Address
89.31.82.185 72.14.185.187
Artifacts (3)
rundll32.exe cmd.exe cipher.exe
Capability
50%
40 technique(s) 41 tool(s)/malware 13 CVE(s)
BARIUM BlackEnergy CHOPSTICK DarkPulsar Downdelph Erebus Forfiles Global +33
T1516
collection
T1005 T1025 T1039 T1074 +4
command and control
T1001 T1071 T1092 T1573
credential access
T1110 T1552.004 T1557
Victim
70%

Targeted Sectors

government media financial-services defense telecommunications education nuclear energy non-profit chemical healthcare hospitality retail think-tank transportation critical-infrastructure

Targeted Countries

RU FR US UA CA DE CN RO IL KP GB IN NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

BARIUM BlackEnergy CHOPSTICK
2 Weaponization

Capability (Techniques)

T1583 T1584 T1586

Capability (Malware)

BARIUM BlackEnergy CHOPSTICK
3 Delivery

Capability (Techniques)

T1189 T1190

Capability (Malware)

BARIUM BlackEnergy CHOPSTICK
4 Exploitation

Capability (Techniques)

T1059 T1203 T1068 T1546

Capability (Malware)

BARIUM BlackEnergy CHOPSTICK
5 Installation

Capability (Malware)

BARIUM BlackEnergy CHOPSTICK
6 Command & Control

Capability (Malware)

BARIUM BlackEnergy CHOPSTICK
7 Actions on Objectives

Capability (Techniques)

T1030 T1048 T1567 T1561

Capability (Malware)

BARIUM BlackEnergy CHOPSTICK
Leaving Threaticon

This link opens an external site that isn't part of the platform.