Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
BlackMaskers (threat actor)
Risk
76
Critical
16 techniques 45 tools/malware 2 vulnerabilities 12 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
4
T1059.003
Windows Command Shell execution
T1559.002
Dynamic Data Exchange execution
CVE CVE-2026-20316
CVE CVE-2026-63077
›
5 Installation
3
T1552
Unsecured Credentials credential access
T1133
External Remote Services persistence
T1525
Implant Internal Image persistence
›
6 Command & Control
2
T1560
Archive Collected Data collection
T1560.001
Archive via Utility collection
›
7 Actions on Objectives
8
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
T1036
Masquerading stealth
T1078
Valid Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1081
T1081
Stage risk: Critical High Medium None

Tools & Malware (45)

Agent Tesla Backdoors Black Basta BlackBasta BlackByte BlackByte Ransomware BlackCat BlackCat BlackEnergy BlackMatter BlackMatter ransomware BlackSuit Chaos Cobalt Cobalt Strike Conti Dark DarkSide Ghost RAT Global HELLOKITTY Havex RAT Infostealer Legitimate Software Leverage LockBit Lynx Mimikatz Mythic Nokoyawa Ransomware Phishing campaigns Phishing emails Phobos PowerShell RansomHub Ransomware variants Royal Royal Ransomware Snake SolarWinds Telegram Trigona Trojan Unknown phishing

Indicators of Compromise (12)

Domain
PROXY.AM TEMP.Akapav TEMP.Jumper TEMP.Periscope TEMP.Hex README.txt Temp.Overboard Kamikaze.sh +1 more
Email Address
commercial@malwarepatrol.net
Filename
black-basta-threat-profile.pdf GA.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (5)
M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program M1048 Application Isolation and Sandboxing M1054 Software Configuration
Installation (16)
M1015 Active Directory Configuration M1017 User Training M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +11 more
Command & Control (1)
M1047 Audit
Actions on Objectives (20)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +15 more

Detection Coverage

15 strategies
5/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0504 Detect Abuse of Dynamic Data Exchange (T...

Installation (3)

DET0334 Detection Strategy for T1525 – Implant I... DET0354 Behavior-chain detection for T1133 Exter... DET0412 Detect Access or Search for Unsecured Cr...

Command & Control (2)

DET0298 Detect Archiving via Utility (T1560.001) DET0526 Detect Archiving and Encryption of Colle...

Actions on Objectives (7)

DET0127 Behavioral Detection of Masquerading Acr... DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0275 Detect Adversary Deobfuscation or Decodi... DET0495 Detection Strategy for Financial Theft +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

BlackMaskers

Type: Unknown Active
BlackMaskers Team tracked as the Newscaster Team dies Februtas named after the +8 more
Infrastructure 9 IOC(s)
50%
Domain
PROXY.AM TEMP.Akapav TEMP.Jumper TEMP.Periscope TEMP.Hex +4
Artifacts (3)
commercial@malwarepatrol.net black-basta-threat-profile.pdf GA.js
Capability
50%
16 technique(s) 45 tool(s)/malware 2 CVE(s)
Agent Tesla Backdoors Black Basta BlackBasta BlackByte BlackByte Ransomware BlackCat BlackCat +37
T1081
collection
T1560 T1560.001
credential access
T1552
execution
T1059.003 T1559.002
Victim
70%

Targeted Sectors

financial-services government critical-infrastructure defense telecommunications education healthcare manufacturing media maritime retail non-profit hospitality food-agriculture aerospace information-technology entertainment energy nuclear gaming construction transportation

Targeted Countries

AE IL RU IR GB UA IN CN KP DE PK BY PL TW CA AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Agent Tesla Backdoors Black Basta
4 Exploitation

Capability (Techniques)

T1059.003 T1559.002

Capability (Malware)

Agent Tesla Backdoors Black Basta
5 Installation

Capability (Techniques)

T1552 T1133 T1525

Capability (Malware)

Agent Tesla Backdoors Black Basta
6 Command & Control

Capability (Techniques)

T1560 T1560.001

Capability (Malware)

Agent Tesla Backdoors Black Basta
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

Agent Tesla Backdoors Black Basta
Leaving Threaticon

This link opens an external site that isn't part of the platform.