Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Water Kurita (threat actor)
Risk
85
Critical
19 techniques 46 tools/malware 4 vulnerabilities 23 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
3
T1190
Exploit Public-Facing Application initial access
T1195
Supply Chain Compromise initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
6
T1053.006
Systemd Timers execution
T1059.004
Unix Shell execution
CVE CVE-2025-61882
CVE CVE-2026-60004
CVE CVE-2026-60137
CVE CVE-2026-63030
›
5 Installation
3
T1528
Steal Application Access Token credential access
T1082
System Information Discovery discovery
T1133
External Remote Services persistence
›
6 Command & Control
3
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1571
Non-Standard Port command and control
›
7 Actions on Objectives
8
T1041
Exfiltration Over C2 Channel exfiltration
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1055
Process Injection stealth
T1078
Valid Accounts stealth
T1078.004
Cloud Accounts stealth
T1620
Reflective Code Loading stealth
T1064
T1064
Stage risk: Critical High Medium None

Tools & Malware (46)

Amadey ClickFix Derusbi Derusbi Disco Duqu Empire FakeGit Gentlemen Ghost RAT GhostSocks GitHub Global Information-stealing malware Infostealer JavaScript payloads Legitimate Software Leverage Lumma Stealer LummaC2 LummaStealer MESSAGETAP Messagetap Mirai MuddyWater Nefilim Nefilim Ransomware Payload Payload Phishing emails PlugX PowerShell PowerShell commands PowerShell scripts Resident Scheduled Tasks SmartLoader Stealc Telegram Unknown Vidar WhatsApp Winnti curl malware distribution phishing

Indicators of Compromise (23)

Domain
TrojanSpy.Win64.LUMMASTEALER.THKAABE SecurityOnline.info jamelik.asia pasteflawwed.world water-kurita-lumma-stealer-doxxing.html userdata.txt MCP.so pabuloa.asia
Email Address
info@rescana.com support@hexnode.com partners@hexnode.com Info@rescana.com
Filename
mid.bat chrome.exe Release.zip Software.zip lua51.dll MicrosoftEdgeUpdate.exe Launcher.bat luajit.exe +2 more
SHA-256 Hash
516cd47d091622b3eb256d25b984a5ede0d5dd9540e342a28e199082395e65e5

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (16)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +11 more
Exploitation (4)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1038 Execution Prevention
Installation (8)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication +3 more
Command & Control (3)
M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (16)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +11 more

Detection Coverage

18 strategies
5/7 stages covered

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (2)

DET0231 Behavioral Detection of Systemd Timer Ab... DET0384 Behavioral Detection of Unix Shell Execu...

Installation (3)

DET0354 Behavior-chain detection for T1133 Exter... DET0515 Detection Strategy for T1528 - Steal App... DET0525 System Discovery via Native and Remote U...

Command & Control (3)

DET0027 Detection of Web Protocol-Based C2 Over... DET0227 Detection Strategy for Non-Standard Port... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (7)

DET0127 Behavioral Detection of Masquerading Acr... DET0300 Detection Strategy for Reflective Code L... DET0348 Detection Strategy for Exfiltration Over... DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Water Kurita

Type: Unknown Active
Storm-2477 tracked as
Infrastructure 8 IOC(s)
50%
Domain
TrojanSpy.Win64.LUMMASTEALER.THKAABE SecurityOnline.info jamelik.asia pasteflawwed.world water-kurita-lumma-stealer-doxxing.html +3
Artifacts (15)
info@rescana.com support@hexnode.com partners@hexnode.com Info@rescana.com mid.bat chrome.exe +9
Capability
50%
19 technique(s) 46 tool(s)/malware 4 CVE(s)
Amadey ClickFix Derusbi Derusbi Disco Duqu Empire FakeGit +38
T1064
command and control
T1071 T1071.001 T1571
credential access
T1528
discovery
T1082
Victim
70%

Targeted Sectors

media financial-services pharmaceutical critical-infrastructure aviation government defense

Targeted Countries

CN IR IL JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1195 T1566.002

Capability (Malware)

Amadey ClickFix Derusbi
4 Exploitation

Capability (Techniques)

T1053.006 T1059.004

Capability (Malware)

Amadey ClickFix Derusbi
5 Installation

Capability (Techniques)

T1528 T1082 T1133

Capability (Malware)

Amadey ClickFix Derusbi
6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1571

Capability (Malware)

Amadey ClickFix Derusbi
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Amadey ClickFix Derusbi
Leaving Threaticon

This link opens an external site that isn't part of the platform.