Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Infrastructure Destruction Squad (threat actor)
Risk
61
High
9 techniques 43 tools/malware 1 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1195.001
Compromise Software Dependencies and Development Tools initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
3
T1059.003
Windows Command Shell execution
T1204.002
Malicious File execution
CVE CVE-2015-1701
›
5 Installation
No data
›
6 Command & Control
1
T1071.004
DNS command and control
›
7 Actions on Objectives
4
T1486
Data Encrypted for Impact impact
T1490
Inhibit System Recovery impact
T1508.001
T1508.001
T1595.006
T1595.006
Stage risk: Critical High Medium None

Tools & Malware (43)

Anchor Buhtrap Carbon Cobalt DEADEYE Dark DarkHotel Gentlemen Global Handala Hellsing Hidden Cobra Infy InvisiMole Jackal Leverage Matrix Mirage Naikon Nexus Nitro PLAY Phishing emails Poseidon Predator Samurai Shamoon Shark Spear-phishing Spear‑phishing Kit TeamSpy Telegram Tsunami Turla UNC1549 Unknown VERMIN VICEROY Void WhatsApp WordPress Exploit Module gcman phishing

Indicators of Compromise (40)

Domain
demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +32 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

16 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (11)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +6 more
Exploitation (3)
M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (5)
M1018 User Account Management M1028 Operating System Configuration M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup

Detection Coverage

7 strategies
4/7 stages covered

Delivery (2)

DET0009 Supply-chain tamper in dependencies/dev-... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down...

Command & Control (1)

DET0400 Behavioral Detection of DNS Tunneling an...

Actions on Objectives (2)

DET0215 Detection of Multi-Platform File Encrypt... DET0329 Behavioral Detection for T1490 - Inhibit...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Infrastructure Destruction Squad

Type: Unknown Active
Dark Engine tracked as the Newscaster Team primarily exposing HMIs Sector 16 +21 more
Infrastructure 40 IOC(s)
50%
Domain
demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +35
Capability
50%
9 technique(s) 43 tool(s)/malware 1 CVE(s)
Anchor Buhtrap Carbon Cobalt DEADEYE Dark DarkHotel Gentlemen +35
T1508.001 T1595.006
command and control
T1071.004
execution
T1059.003 T1204.002
impact
T1486 T1490
Victim
70%

Targeted Sectors

defense government financial-services manufacturing aerospace non-profit energy telecommunications media education information-technology critical-infrastructure maritime healthcare think-tank chemical pharmaceutical nuclear legal-services mining transportation hospitality entertainment

Targeted Countries

US CN UA RU JP IN GB DE IR KR IL FR TW SA TR CA AU KZ PK VN PL IT AE SG NL BR ES IQ BY SY MX RO KP EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1195.001 T1566.001

Capability (Malware)

Anchor Buhtrap Carbon
4 Exploitation

Capability (Techniques)

T1059.003 T1204.002

Capability (Malware)

Anchor Buhtrap Carbon
6 Command & Control

Capability (Techniques)

T1071.004

Capability (Malware)

Anchor Buhtrap Carbon
7 Actions on Objectives

Capability (Techniques)

T1486 T1490

Capability (Malware)

Anchor Buhtrap Carbon
Leaving Threaticon

This link opens an external site that isn't part of the platform.