Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
GrayCharlie (threat actor)
Risk
79
Critical
10 techniques 41 tools/malware 12 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
13
T1204
User Execution execution
CVE CVE-2022-20775
CVE CVE-2024-28986
CVE CVE-2024-28988
CVE CVE-2025-26399
CVE CVE-2025-40536
CVE CVE-2025-40552
CVE CVE-2025-40553
CVE CVE-2025-40554
CVE CVE-2025-49113
CVE CVE-2025-59536
CVE CVE-2025-68461
CVE CVE-2026-20127
›
5 Installation
1
T1133
External Remote Services persistence
›
6 Command & Control
2
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
4
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
Stage risk: Critical High Medium None

Tools & Malware (41)

Backdoors BlackCat BlackSuit ClickFix Cobalt Cobalt Strike Compromised WordPress Sites Conti Dark Ghost RAT Global HELLOKITTY Leverage LockBit Lynx Medusa Mimikatz Mythic NetSupport RAT Nokoyawa Ransomware Payload Payload Phishing campaigns Phishing emails Phobos PowerShell Qilin Ransomware variants RoundCube Royal Royal Ransomware SectopRAT SmartApeSG SolarWinds Stealc Trigona Unknown Vidar YARA curl phishing

Indicators of Compromise (40)

Domain
filmlerzltyazilimsx.shop persistancejs.store bianchilawgroup.com mailum.com RSSing.com Hunt.io
Filename
client32.exe
IPv4 Address
194.180.191.171 5.181.159.60 194.180.191.17 94.158.245.66 94.158.245.81 185.225.17.74 194.180.191.189 5.252.178.123 +25 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (10)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +5 more
Exploitation (6)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +1 more
Installation (5)
M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +5 more

Detection Coverage

10 strategies
5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0478 User Execution – multi-surface behavior...

Installation (1)

DET0354 Behavior-chain detection for T1133 Exter...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (4)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft DET0548 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

GrayCharlie

Type: Unknown Active
ArechClient2 tracked as Nitroade Hauler ZPHP HANEYMANEY +9 more
Infrastructure 39 IOC(s)
50%
Domain
filmlerzltyazilimsx.shop persistancejs.store bianchilawgroup.com mailum.com RSSing.com +1
IPv4 Address
194.180.191.171 5.181.159.60 194.180.191.17 94.158.245.66 94.158.245.81 +28
Artifacts (1)
client32.exe
Capability
50%
10 technique(s) 41 tool(s)/malware 12 CVE(s)
Backdoors BlackCat BlackSuit ClickFix Cobalt Cobalt Strike Compromised WordPress Sites Conti +33
command and control
T1071.001 T1105
execution
T1204
exfiltration
T1048 T1567
impact
T1486 T1657
Victim
70%

Targeted Sectors

financial-services legal-services government healthcare defense education telecommunications critical-infrastructure manufacturing media retail gaming non-profit information-technology hospitality aerospace maritime nuclear entertainment food-agriculture construction transportation

Targeted Countries

US CN RU IN UA GB DE KP IR PK BY PL TW CA AU JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1190

Capability (Malware)

Backdoors BlackCat BlackSuit
4 Exploitation

Capability (Techniques)

T1204

Capability (Malware)

Backdoors BlackCat BlackSuit
5 Installation

Capability (Techniques)

T1133

Capability (Malware)

Backdoors BlackCat BlackSuit
6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

Backdoors BlackCat BlackSuit
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

Backdoors BlackCat BlackSuit
Leaving Threaticon

This link opens an external site that isn't part of the platform.