Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Cyber Serp (threat actor)
Risk
70
High
11 techniques 53 tools/malware 3 vulnerabilities 23 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1189
Drive-by Compromise initial access
T1566
Phishing initial access
›
4 Exploitation
7
T1053
Scheduled Task/Job execution
T1053.005
Scheduled Task execution
T1204
User Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2015-1701
CVE CVE-2025-66376
CVE CVE-2026-50522
›
5 Installation
No data
›
6 Command & Control
2
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
3
T1041
Exfiltration Over C2 Channel exfiltration
T1027
Obfuscated Files or Information stealth
T1193
T1193
Stage risk: Critical High Medium None

Tools & Malware (53)

AGEWHEEZE AGEWHEEZE RAT Ababil Anchor Buhtrap CloudDuke (MiniDionis) Cobalt CosmicDuke CozyDuke DEADEYE Dark DarkHotel Dropping Elephant ELMER GeminiDuke Global HammerDuke (Hammertoss) Hellsing Hidden Cobra IRONHALO Icefog Jackal KryBit Lynx Matrix MiniDuke Mirage Mythic Naikon Nexus Nitro OnionDuke Phishing campaigns Phishing emails PinchDuke Poseidon Predator Samurai SeaDuke Shamoon Shark Snake Spear-phishing TeamSpy Telegram Trojan Tsunami Turla VICEROY Void curl gcman phishing

Indicators of Compromise (23)

Domain
demo-cloud.space cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao +13 more
Email Address
incidents@cert-ua.tech
IPv4 Address
54.36.237.92

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (9)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1048 Application Isolation and Sandboxing +4 more
Exploitation (15)
M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +10 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (6)
M1017 User Training M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1047 Audit M1049 Antivirus/Antimalware +1 more

Detection Coverage

10 strategies
4/7 stages covered

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (4)

DET0094 Cross-Platform Behavioral Detection of S... DET0441 Detection of Suspicious Scheduled Task C... DET0478 User Execution – multi-surface behavior... DET0514 Detection Strategy for Exploitation for...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (2)

DET0348 Detection Strategy for Exfiltration Over... DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Cyber Serp

Type: Unknown Active
UAC-0255 tracked as 27 2026 cpyy +18 more
Infrastructure 22 IOC(s)
50%
Domain
demo-cloud.space cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad +16
IPv4 Address
54.36.237.92
Artifacts (1)
incidents@cert-ua.tech
Capability
50%
11 technique(s) 53 tool(s)/malware 3 CVE(s)
AGEWHEEZE AGEWHEEZE RAT Ababil Anchor Buhtrap CloudDuke (MiniDionis) Cobalt CosmicDuke +45
T1193
command and control
T1071.001 T1105
execution
T1053 T1053.005 T1204
exfiltration
T1041
Victim
70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications education aerospace media healthcare information-technology maritime manufacturing think-tank pharmaceutical chemical mining hospitality legal-services nuclear entertainment

Targeted Countries

US UA CN GB IN JP DE KR RU IR SA TW FR CA IL TR AU KZ PK IT VN PL AE SG NL BR ES IQ BY SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566

Capability (Malware)

AGEWHEEZE AGEWHEEZE RAT Ababil
4 Exploitation

Capability (Malware)

AGEWHEEZE AGEWHEEZE RAT Ababil
6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

AGEWHEEZE AGEWHEEZE RAT Ababil
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AGEWHEEZE AGEWHEEZE RAT Ababil
Leaving Threaticon

This link opens an external site that isn't part of the platform.