Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
SHADOW-VOID-042 (threat actor)
Risk
91
Critical
25 techniques 53 tools/malware 15 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
20
T1053.006
Systemd Timers execution
T1059
Command and Scripting Interpreter execution
T1203
Exploitation for Client Execution execution
T1204.002
Malicious File execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2018-6065
CVE CVE-2021-26084
CVE CVE-2021-31207
CVE CVE-2021-34473
CVE CVE-2021-34523
CVE CVE-2022-26318
CVE CVE-2023-22518
CVE CVE-2023-27532
CVE CVE-2024-3400
CVE CVE-2024-3721
CVE CVE-2024-40711
CVE CVE-2024-40766
CVE CVE-2025-22457
›
5 Installation
2
T1003.004
LSA Secrets credential access
T1133
External Remote Services persistence
›
6 Command & Control
5
T1005
Data from Local System collection
T1090
Proxy command and control
T1095
Non-Application Layer Protocol command and control
T1105
Ingress Tool Transfer command and control
T1219
Remote Access Tools command and control
›
7 Actions on Objectives
11
T1484.001
Group Policy Modification defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1499
Endpoint Denial of Service impact
T1657
Financial Theft impact
T1027
Obfuscated Files or Information stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1204.0
T1204.0
Stage risk: Critical High Medium None

Tools & Malware (53)

Akira Backdoor.Syskit Backdoors BlackByte Broadside China Chopper / Ckife Webshells Cobalt Cobalt Strike Conti Custom malware Dark Expand GalaxyGato Global GoRed Infostealer/Sha.exe/Sha432.exe Infostealer/stereoversioncontrol.exe Kimsuky LazyCat Leverage LockBit Lynx Machete Mirai MuddyWater Mythic OilRig PLAY Payload Payload Phishing campaigns Phishing emails Poison Frog PowerShell RedCurl Remote access tools Royal STOP SocGholish SolarWinds Spear-phishing Spear-phishing emails Sting Telegram Trojan Turla Unknown Void Winnti ZeroLot get-logon-history.ps1 phishing reGeorge

Indicators of Compromise (40)

Domain
TEMP.Veles TEMP.Zagros Temp.Zagros TEMP.Akapav TEMP.Jumper TEMP.Periscope TEMP.Hex unpkg.com +22 more
Email Address
rocke@live.cn
Filename
Version.dll It11.exe MSBuild.exe eskle.sys MMpLics.dll esentutl.exe SystemProcessHost.exe conhost.exe +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (16)
M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +11 more
Installation (8)
M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies M1030 Network Segmentation +3 more
Command & Control (9)
M1020 SSL/TLS Inspection M1030 Network Segmentation M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic +4 more
Actions on Objectives (13)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +8 more

Detection Coverage

24 strategies
5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0231 Behavioral Detection of Systemd Timer Ab... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0514 Detection Strategy for Exploitation for... DET0516 Behavioral Detection of Command and Scri...

Installation (2)

DET0354 Behavior-chain detection for T1133 Exter... DET0437 Detection of LSA Secrets Dumping via Reg...

Command & Control (5)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0380 Detection of Local Data Collection Prior... DET0445 Detection of Proxy Infrastructure Setup... DET0457 Detection of Non-Application Layer Proto... DET0496 Behavior-Chain Detection for Remote Acce...

Actions on Objectives (10)

DET0131 Behavioral Detection Strategy for Exfilt... DET0146 Detection of Data Destruction Across Pla... DET0208 Endpoint Resource Saturation and Crash P... DET0215 Detection of Multi-Platform File Encrypt... DET0275 Detect Adversary Deobfuscation or Decodi... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

SHADOW-VOID-042

Type: Unknown Active
Storm-0978 Tropical Scorpius APT28 Smoke Sandstorm tracked as +84 more
Infrastructure 30 IOC(s)
50%
Domain
TEMP.Veles TEMP.Zagros Temp.Zagros TEMP.Akapav TEMP.Jumper +25
Artifacts (10)
rocke@live.cn Version.dll It11.exe MSBuild.exe eskle.sys MMpLics.dll +4
Capability
53%
25 technique(s) 53 tool(s)/malware 15 CVE(s)
Akira Backdoor.Syskit Backdoors BlackByte Broadside China Chopper / Ckife Webshells Cobalt Cobalt Strike +45
T1204.0
collection
T1005
command and control
T1090 T1095 T1105 T1219
credential access
T1003.004
Victim
70%

Targeted Sectors

government financial-services defense telecommunications manufacturing healthcare energy education critical-infrastructure transportation media non-profit aerospace pharmaceutical aviation hospitality retail information-technology chemical maritime gaming think-tank construction food-agriculture mining entertainment legal-services nuclear utilities oil-gas

Targeted Countries

CN US RU UA IR GB IN BY JP TW IL AE KP VN AU PK DE SA MX CA SG KR PL TR FR ES RO NG IT LB AZ KZ EG BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Akira Backdoor.Syskit Backdoors
4 Exploitation

Capability (Malware)

Akira Backdoor.Syskit Backdoors
5 Installation

Capability (Techniques)

T1003.004 T1133

Capability (Malware)

Akira Backdoor.Syskit Backdoors
6 Command & Control

Capability (Malware)

Akira Backdoor.Syskit Backdoors
7 Actions on Objectives

Capability (Malware)

Akira Backdoor.Syskit Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.