Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
313 Team (threat actor)
Risk
100
Critical
34 techniques 47 tools/malware 9 vulnerabilities 38 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1595
Active Scanning reconnaissance
T1598
Phishing for Information reconnaissance
›
2 Weaponization
3
T1583
Acquire Infrastructure resource development
T1585
Establish Accounts resource development
T1588
Obtain Capabilities resource development
›
3 Delivery
5
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
13
T1053
Scheduled Task/Job execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1072
Software Deployment Tools execution
CVE CVE-2017-7921
CVE CVE-2021-33044
CVE CVE-2021-36260
CVE CVE-2023-33538
CVE CVE-2023-6895
CVE CVE-2025-20333
CVE CVE-2025-20362
CVE CVE-2025-34067
CVE CVE-2026-20182
›
5 Installation
1
T1110.003
Password Spraying credential access
›
6 Command & Control
6
T1005
Data from Local System collection
T1113
Screen Capture collection
T1530
Data from Cloud Storage collection
T1071.001
Web Protocols command and control
T1071.004
DNS command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
13
T1567
Exfiltration Over Web Service exfiltration
T1485
Data Destruction impact
T1491
Defacement impact
T1491.001
Internal Defacement impact
T1491.002
External Defacement impact
T1498
Network Denial of Service impact
T1499
Endpoint Denial of Service impact
T1561
Disk Wipe impact
T1565
Data Manipulation impact
T1078
Valid Accounts stealth
T1078.004
Cloud Accounts stealth
T0813
T0813
T0835
T0835
Stage risk: Critical High Medium None

Tools & Malware (47)

Backdoors Beacon BiBi CanisterWorm Dark Darkcomp Destructive Malware Dindoor Epic Fakeset GitHub GitHub repository deployments Global Guard Hamsa Handala Hatef HawkEye Infostealer Intune LOTUSLITE Leverage MuddyWater NSIS NSIS installer OilRig Payload Payload Phishing campaigns PowerShell Rclone STOP SUNBURST Spear-phishing Spear-phishing Campaigns Spear‑phishing toolkit Specter Stagecomp Stealc Telegram Telegram bot Telegram channels Unknown Void Wiper malware YARA phishing

Indicators of Compromise (38)

Domain
Ubuntu.com www.bleepingcomputer.com Mallory.ai FalconFeeds.io mod.gov.kw kuwaitarmy.gov.kw www.portal.0111etisalat.com check-host.net +28 more
URL
http://iuumfgrrnuhb.zhivachkapro.com/pobor http://terymar.com/install/Spf.ps1

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

32 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (3)
M1017 User Training M1054 Software Configuration M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (19)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more
Installation (3)
M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies
Command & Control (8)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic +3 more
Actions on Objectives (16)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +11 more

Detection Coverage

32 strategies
7/7 stages covered

Reconnaissance (2)

DET0823 Detection of Phishing for Information DET0830 Detection of Active Scanning

Weaponization (3)

DET0850 Detection of Obtain Capabilities DET0873 Detection of Establish Accounts DET0895 Detection of Acquire Infrastructure

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0094 Cross-Platform Behavioral Detection of S... DET0223 Detection of Adversary Abuse of Software... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri...

Installation (1)

DET0487 Distributed Password Spraying via Authen...

Command & Control (6)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0346 Detect Screen Capture via Commands and A... DET0380 Detection of Local Data Collection Prior... DET0400 Behavioral Detection of DNS Tunneling an... +1 more

Actions on Objectives (11)

DET0059 Detection Strategy for Data Manipulation DET0082 Internal Website and System Content Defa... DET0137 Detection Strategy for Disk Wipe via Dir... DET0146 Detection of Data Destruction Across Pla... DET0208 Endpoint Resource Saturation and Crash P... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

313 Team

Type: Unknown Active
DarkStorm 313 Team Hack Team Islamic Cyber Resistance Earth Bluecrow DecisiveArchitect +20 more
Infrastructure 38 IOC(s)
50%
Domain
Ubuntu.com www.bleepingcomputer.com Mallory.ai FalconFeeds.io mod.gov.kw +31
URL
http://iuumfgrrnuhb.zhivachkapro.com/pobor http://terymar.com/install/Spf.ps1
Capability
50%
34 technique(s) 47 tool(s)/malware 9 CVE(s)
Backdoors Beacon BiBi CanisterWorm Dark Darkcomp Destructive Malware Dindoor +39
T0813 T0835
collection
T1005 T1113 T1530
command and control
T1071.001 T1071.004 T1105
credential access
T1110.003
Victim
70%

Targeted Sectors

government defense financial-services healthcare energy telecommunications media manufacturing critical-infrastructure non-profit education nuclear information-technology aerospace transportation pharmaceutical utilities aviation oil-gas construction think-tank

Targeted Countries

IR IL US IQ AE SA UA RU LB CN TR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595 T1598

Capability (Malware)

Backdoors Beacon BiBi
2 Weaponization

Capability (Techniques)

T1583 T1585 T1588

Capability (Malware)

Backdoors Beacon BiBi
3 Delivery

Capability (Malware)

Backdoors Beacon BiBi
4 Exploitation

Capability (Malware)

Backdoors Beacon BiBi
5 Installation

Capability (Techniques)

T1110.003

Capability (Malware)

Backdoors Beacon BiBi
6 Command & Control

Capability (Malware)

Backdoors Beacon BiBi
7 Actions on Objectives

Capability (Malware)

Backdoors Beacon BiBi
Leaving Threaticon

This link opens an external site that isn't part of the platform.