Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
SHADOW-AETHER-015 (threat actor)
Risk
90
Critical
27 techniques 46 tools/malware 3 vulnerabilities 29 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1589.002
Email Addresses reconnaissance
›
2 Weaponization
1
T1583.001
Domains resource development
›
3 Delivery
3
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
4
T1204
User Execution execution
CVE CVE-2014-4114
CVE CVE-2015-3113
CVE CVE-2026-35273
›
5 Installation
2
T1187
Forced Authentication credential access
T1505.003
Web Shell persistence
›
6 Command & Control
No data
›
7 Actions on Objectives
19
T1027
Obfuscated Files or Information stealth
T1027.001
Binary Padding stealth
T1027.002
Software Packing stealth
T1027.003
Steganography stealth
T1027.004
Compile After Delivery stealth
T1027.005
Indicator Removal from Tools stealth
T1027.006
HTML Smuggling stealth
T1027.007
Dynamic API Resolution stealth
T1027.008
Stripped Payloads stealth
T1027.009
Embedded Payloads stealth
T1027.010
Command Obfuscation stealth
T1027.011
Fileless Storage stealth
T1027.012
LNK Icon Smuggling stealth
T1027.013
Encrypted/Encoded File stealth
T1027.014
Polymorphic Code stealth
T1027.015
Compression stealth
T1027.016
Junk Code Insertion stealth
T1027.017
SVG Smuggling stealth
T1027.018
Invisible Unicode stealth
Stage risk: Critical High Medium None

Tools & Malware (46)

Akira AppleJeus AvosLocker Backdoors Beacon BlackByte Bumblebee Carbanak Carbon Cobalt Conti Dark DarkGate Ebury Global Industroyer Kazuar Kimsuky LODEINFO Leverage Moonstone Sleet MuddyWater Naikon OceanLotus OilRig OopsIE Payload Payload PlugX PoisonIvy PowerShell RedCurl SUNBURST SYLVANITE ShadowPad Spear-phishing TONESHELL TrickBot Trojan Turla Valak Void Volt Typhoon Web Shell Winnti phishing

Indicators of Compromise (29)

Domain
M.Leveille TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex Agent.btz Trojan.Karagany Trojan.Hydraq +19 more
Email Address
rocke@live.cn
Filename
MsBuild.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (6)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +1 more
Installation (4)
M1018 User Account Management M1027 Password Policies M1037 Filter Network Traffic M1042 Disable or Remove Feature or Program
Actions on Objectives (5)
M1017 User Training M1040 Behavior Prevention on Endpoint M1047 Audit M1048 Application Isolation and Sandboxing M1049 Antivirus/Antimalware

Detection Coverage

27 strategies
6/7 stages covered

Reconnaissance (1)

DET0814 Detection of Email Addresses

Weaponization (1)

DET0892 Detection of Domains

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0478 User Execution – multi-surface behavior...

Installation (2)

DET0022 Detect Forced SMB/WebDAV Authentication... DET0394 Web Shell Detection via Server Behavior...

Actions on Objectives (19)

DET0019 Detection Strategy for Stripped Payloads... DET0023 Obfuscated Binary Unpacking Detection vi... DET0087 Encrypted or Encoded File Payload Detect... DET0091 Detection Strategy for Dynamic API Resol... DET0119 Detection Strategy for Steganographic Ab... +14 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

SHADOW-AETHER-015

Type: Unknown Active
tracked as Mustang Panda sophisticated phishing attacks Sandworm Team Operation Cleaver +10 more
Infrastructure 27 IOC(s)
50%
Domain
M.Leveille TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex +22
Artifacts (2)
rocke@live.cn MsBuild.exe
Capability
50%
27 technique(s) 46 tool(s)/malware 3 CVE(s)
Akira AppleJeus AvosLocker Backdoors Beacon BlackByte Bumblebee Carbanak +38
credential access
T1187
execution
T1204
initial access
T1190 T1566.001 T1566.002
persistence
T1505.003
Victim
70%

Targeted Sectors

government financial-services telecommunications defense healthcare education manufacturing non-profit energy critical-infrastructure media hospitality aviation pharmaceutical aerospace information-technology transportation think-tank retail gaming maritime mining chemical legal-services utilities nuclear entertainment oil-gas construction

Targeted Countries

US CN RU UA IR AU GB VN JP IL SA PK TW AE IN SG BY BR CA KR DE TR MX ES PL AZ RO FR NG KP IT LB KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.002

Capability (Malware)

Akira AppleJeus AvosLocker
2 Weaponization

Capability (Techniques)

T1583.001

Capability (Malware)

Akira AppleJeus AvosLocker
3 Delivery

Capability (Techniques)

T1190 T1566.001 T1566.002

Capability (Malware)

Akira AppleJeus AvosLocker
4 Exploitation

Capability (Techniques)

T1204

Capability (Malware)

Akira AppleJeus AvosLocker
5 Installation

Capability (Techniques)

T1187 T1505.003

Capability (Malware)

Akira AppleJeus AvosLocker
Leaving Threaticon

This link opens an external site that isn't part of the platform.