Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
WhiteCobra (threat actor)
Risk
86
Critical
17 techniques 45 tools/malware 3 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
2
T1583.006
Web Services resource development
T1584
Compromise Infrastructure resource development
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
5
T1059.001
PowerShell execution
T1546.006
LC_LOAD_DYLIB Addition privilege escalation
CVE CVE-2024-21907
CVE CVE-2024-40766
CVE CVE-2025-55234
›
5 Installation
3
T1082
System Information Discovery discovery
T1037.003
Network Logon Script persistence
T1133
External Remote Services persistence
›
6 Command & Control
2
T1071.001
Web Protocols command and control
T1550.001
Application Access Token lateral movement
›
7 Actions on Objectives
6
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
T1218.005
Mshta stealth
T1048.004
T1048.004
Stage risk: Critical High Medium None

Tools & Malware (45)

APT38 Akira AppleJeus Backdoors BlackByte BlackBytes/LockBit style backdoors BlackSuit Carbanak Cobalt Cobalt Strike Cobalt Strike "Cobalt" Confucius Conti Cursor Custom VS Code malicious extensions (e.g., Cursor, Cobalt Strike variants) Custom malware Dark Global Guard Hafnium Hidden Cobra Kimsuky LockBit LummaStealer Lynx Medusa MuddyWater Mythic Naikon Open-source tools PLAY Payload Payload Phishing emails PowerShell PowerShell scripts Qilin Remote access tools Royal Snake Trojan Venomous Void Winnti phishing

Indicators of Compromise (40)

Domain
pages.dev InfoStealer.Win.Lumma InfoStealer.Wins.Lumma InfoStealer.Wins.Lumma.ta Trojan.Wins.Lumma.ta cisa.gov TEMP.Veles TEMP.Jumper +28 more
Filename
powershell.exe prompt.js python.exe extension.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (13)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +8 more
Exploitation (6)
M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing M1047 Audit +1 more
Installation (6)
M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network +1 more
Command & Control (7)
M1013 Application Developer Guidance M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1036 Account Use Policies M1037 Filter Network Traffic +2 more
Actions on Objectives (12)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +7 more

Detection Coverage

16 strategies
6/7 stages covered

Weaponization (2)

DET0885 Detection of Compromise Infrastructure DET0896 Detection of Web Services

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (2)

DET0216 Detection Strategy for LC_LOAD_DYLIB Mod... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (3)

DET0354 Behavior-chain detection for T1133 Exter... DET0367 Detect Network Logon Script Abuse via Mu... DET0525 System Discovery via Native and Remote U...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0185 Behavioral Detection Strategy for Use Al...

Actions on Objectives (5)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft DET0506 Detecting Mshta-based Proxy Execution vi... DET0548 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

WhiteCobra

Type: Unknown Active
tracked as Sansevieria mother-in-law's tongue Medicare Advantage simply Cobra +20 more
Infrastructure 36 IOC(s)
50%
Domain
pages.dev InfoStealer.Win.Lumma InfoStealer.Wins.Lumma InfoStealer.Wins.Lumma.ta Trojan.Wins.Lumma.ta +31
Artifacts (4)
powershell.exe prompt.js python.exe extension.js
Capability
50%
17 technique(s) 45 tool(s)/malware 3 CVE(s)
APT38 Akira AppleJeus Backdoors BlackByte BlackBytes/LockBit style backdoors BlackSuit Carbanak +37
T1048.004
command and control
T1071.001
discovery
T1082
execution
T1059.001
Victim
70%

Targeted Sectors

government financial-services telecommunications defense healthcare education manufacturing critical-infrastructure non-profit media energy hospitality retail pharmaceutical aviation aerospace transportation information-technology think-tank gaming entertainment nuclear mining chemical legal-services maritime food-agriculture construction oil-gas utilities

Targeted Countries

US CN RU IR GB UA JP VN AU IN PK TW IL SA DE AE KR BY SG KP PL CA TR MX ES RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.006 T1584

Capability (Malware)

APT38 Akira AppleJeus
3 Delivery

Capability (Techniques)

T1190 T1566.002

Capability (Malware)

APT38 Akira AppleJeus
4 Exploitation

Capability (Techniques)

T1059.001 T1546.006

Capability (Malware)

APT38 Akira AppleJeus
5 Installation

Capability (Techniques)

T1082 T1037.003 T1133

Capability (Malware)

APT38 Akira AppleJeus
6 Command & Control

Capability (Techniques)

T1071.001 T1550.001

Capability (Malware)

APT38 Akira AppleJeus
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

APT38 Akira AppleJeus
Leaving Threaticon

This link opens an external site that isn't part of the platform.