Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UNK_AcademicFlare (threat actor)
Risk
74
High
16 techniques 44 tools/malware 1 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1583.006
Web Services resource development
T1586
Compromise Accounts resource development
T1586.002
Email Accounts resource development
›
3 Delivery
3
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
1
CVE CVE-2015-1701
›
5 Installation
3
T1528
Steal Application Access Token credential access
T1098
Account Manipulation persistence
T1098.003
Additional Cloud Roles persistence
›
6 Command & Control
No data
›
7 Actions on Objectives
6
T1600
Weaken Encryption defense impairment
T1020
Automated Exfiltration exfiltration
T1078
Valid Accounts stealth
T1015
T1015
T1181
T1181
T1594.002
T1594.002
Stage risk: Critical High Medium None

Tools & Malware (44)

Anchor Buhtrap Cobalt Crimson DEADEYE Dark DarkHotel Device code phishing EvilTokens Global Graphish Grizzly Steppe Hidden Cobra Jackal Lynx Matrix Mirage Mythic Naikon Nexus Nitro OilRig Phishing campaigns PlugX Poseidon Predator Samurai SeaDuke Sednit Shamoon Shark Spear-phishing SquarePhish SquarePhish2 SquarePhishV2 Squarephish TeamSpy Tsunami Turla Unknown VICEROY Void gcman phishing

Indicators of Compromise (39)

Domain
infoldium.com TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +19 more
Email Address
robert.pena@FirstTrustAdvisorsLP.onmicrosoft.com no-reply.doc333@ksmus.virtoshare.com
IPv4 Address
196.251.80.184
URL
http://login.microsoftonline.com/common/oauth2/deviceauth http://www.vaultaliy.com/a http://www.virtoshare.com/99 http://onlinedocuments- http://microsoft.com/devicelogin http://progressiveweba.z13.web.core.windows.net http://agimplfundmgt.z13.web.core.windows.net http://blackrockfundmgt.z13.web.core.windows.net +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Installation (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +5 more
Actions on Objectives (8)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +3 more

Detection Coverage

13 strategies
4/7 stages covered

Weaponization (4)

DET0861 Detection of Email Accounts DET0876 Detection of Compromise Accounts DET0895 Detection of Acquire Infrastructure DET0896 Detection of Web Services

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Installation (3)

DET0096 Account Manipulation Behavior Chain Dete... DET0277 Detection Strategy for Role Addition to... DET0515 Detection Strategy for T1528 - Steal App...

Actions on Objectives (3)

DET0339 Detection Strategy for Weaken Encryption... DET0397 Automated Exfiltration Detection Strateg... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UNK_AcademicFlare

Type: Unknown Active
cpyy APT3 Gothic Panda UPS Team DeputyDog +16 more
Infrastructure 37 IOC(s)
50%
Domain
infoldium.com TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +22
IPv4 Address
196.251.80.184
URL
http://login.microsoftonline.com/common/oauth2/deviceauth http://www.vaultaliy.com/a http://www.virtoshare.com/99 http://onlinedocuments- http://microsoft.com/devicelogin +4
Artifacts (2)
robert.pena@FirstTrustAdvisorsLP.onmicrosoft.com no-reply.doc333@ksmus.virtoshare.com
Capability
50%
16 technique(s) 44 tool(s)/malware 1 CVE(s)
Anchor Buhtrap Cobalt Crimson DEADEYE Dark DarkHotel Device code phishing +36
T1015 T1181 T1594.002
credential access
T1528
defense impairment
T1600
exfiltration
T1020
Victim
70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy education aerospace media think-tank information-technology healthcare pharmaceutical manufacturing transportation maritime chemical entertainment hospitality mining nuclear gaming legal-services critical-infrastructure retail construction food-agriculture

Targeted Countries

US CN GB RU IN JP KR DE IR FR CA SA TW IL TR AU PK KZ UA ES PL SG VN NL BR IT BY AE IQ MX RO SY AZ EG LB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

Anchor Buhtrap Cobalt
3 Delivery

Capability (Techniques)

T1566 T1566.001 T1566.002

Capability (Malware)

Anchor Buhtrap Cobalt
5 Installation

Capability (Techniques)

T1528 T1098 T1098.003

Capability (Malware)

Anchor Buhtrap Cobalt
7 Actions on Objectives

Capability (Techniques)

T1020

Capability (Malware)

Anchor Buhtrap Cobalt
Leaving Threaticon

This link opens an external site that isn't part of the platform.