Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
verdantbamboo (threat actor)
Risk
96
Critical
47 techniques 47 tools/malware 40 vulnerabilities 37 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1592
Gather Victim Host Information reconnaissance
›
2 Weaponization
No data
›
3 Delivery
3
T1190
Exploit Public-Facing Application initial access
T1195
Supply Chain Compromise initial access
T1566
Phishing initial access
›
4 Exploitation
51
T1053
Scheduled Task/Job execution
T1053.003
Cron execution
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.004
Unix Shell execution
T1059.006
Python execution
T1203
Exploitation for Client Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1548
Abuse Elevation Control Mechanism privilege escalation
T1548.002
Bypass User Account Control privilege escalation
T1548.003
Sudo and Sudo Caching privilege escalation
CVE CVE-2023-46805
CVE CVE-2023-6875
CVE CVE-2024-21887
CVE CVE-2024-23897
CVE CVE-2025-0282
CVE CVE-2025-22457
CVE CVE-2025-26385
CVE CVE-2025-46818
CVE CVE-2025-66430
CVE CVE-2026-0257
CVE CVE-2026-0625
CVE CVE-2026-12569
CVE CVE-2026-12957
CVE CVE-2026-15682
CVE CVE-2026-16812
CVE CVE-2026-20316
CVE CVE-2026-22769
CVE CVE-2026-25526
CVE CVE-2026-3102
CVE CVE-2026-31431
CVE CVE-2026-34926
CVE CVE-2026-35033
CVE CVE-2026-40369
CVE CVE-2026-41089
CVE CVE-2026-42271
CVE CVE-2026-42897
CVE CVE-2026-46817
CVE CVE-2026-48172
CVE CVE-2026-48939
CVE CVE-2026-49176
CVE CVE-2026-50522
CVE CVE-2026-50751
CVE CVE-2026-52830
CVE CVE-2026-5386
CVE CVE-2026-56291
CVE CVE-2026-58644
CVE CVE-2026-63077
CVE CVE-2026-8631
CVE CVE-2026-8632
CVE CVE-2026-9082
›
5 Installation
8
T1649
Steal or Forge Authentication Certificates credential access
T1049
System Network Connections Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1133
External Remote Services persistence
T1505
Server Software Component persistence
T1505.003
Web Shell persistence
T1543
Create or Modify System Process persistence
T1543.002
Systemd Service persistence
›
6 Command & Control
14
T1005
Data from Local System collection
T1213
Data from Information Repositories collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1071.004
DNS command and control
T1090
Proxy command and control
T1090.001
Internal Proxy command and control
T1090.002
External Proxy command and control
T1105
Ingress Tool Transfer command and control
T1219
Remote Access Tools command and control
T1568
Dynamic Resolution command and control
T1021
Remote Services lateral movement
T1021.004
SSH lateral movement
T1570
Lateral Tool Transfer lateral movement
›
7 Actions on Objectives
10
T1556
Modify Authentication Process defense impairment
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1070
Indicator Removal stealth
T1070.004
File Deletion stealth
T1078
Valid Accounts stealth
T1127
Trusted Developer Utilities Proxy Execution stealth
T1497.001
System Checks stealth
T1620
Reflective Code Loading stealth
T1053.004
T1053.004
Stage risk: Critical High Medium None

Tools & Malware (47)

AGENTPSD Akira BRICKSTORM BRICKSTORM backdoor BSD variant of BRICKSTORM Backdoors CALENDAR Chaos ClickFix Cursor Dark Firefox GRIMBOLT Gemini CLI Gentlemen GitHub GlassWorm Global Infostealer Infostealer malware Leverage Microsoft Teams Mimikatz MuddyWater Nexus Node.js PLAY PLENET Payload Payload Phishing campaigns Phishing emails PowerShell Remcos Remcos RAT ScreenConnect SolarWinds Spear-phishing Stealc Telegram Trojan ValleyRAT Vidar Warp WhatsApp npm packages phishing

Indicators of Compromise (37)

Domain
Cal.com securityonline.info Android.MagicAd Context.ai software.vendor host.services.cert.parsed.issuer.organization host.services Nerdbank.Streams +10 more
Filename
Fondue.exe Next.js Node.js protobuf.js OneDrive.exe
MD5 Hash
95dc2289427ed29b8b996d0e3d1b78cb 84ad78b2bab946c3677fdc28ebd8a774 58d4eccc982c9e9b1b98aa62c514e53a 98ee964edeb5a988c3bba8ea1e57fe0e
SHA-1 Hash
f4d77958a12a0778283d3e679b24b18f82e332c4 e952c18272efa1c3d73d0a5381bcf443c02743fe f8d93c1769e877aae7e7d5c289a467b5ae371c7a 681075027553546c119ec447eb8df84633dcffce
SHA-256 Hash
e28a96f983b8605decd2ac1db16ebad5fa741a6aa4e585a38ade0e5ad7d6cec0 40d264cf9c73923932c3dfd52d20f46ff602be3fea8dc6ecc71aca46e6067bf5 eb141a43958802727a6c813452450c10b92704bea4474ee5fd87c0a1be326e2e f70abe93112637d3ec2f6c5e058ccac0307ebf63e496f38588cbfc17a8f8a264 ee41e06ed96182ce80cd4544a6abd5d7719c4a5c0e5ddb266a83842d39b99b0a
IPv4 Address
8.8.8.8

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

39 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Delivery (18)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +13 more
Exploitation (17)
M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +12 more
Installation (18)
M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +13 more
Command & Control (17)
M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1027 Password Policies +12 more
Actions on Objectives (21)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +16 more

Detection Coverage

46 strategies
6/7 stages covered

Reconnaissance (1)

DET0826 Detection of Gather Victim Host Informat...

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (11)

DET0052 Behavioral Detection Strategy for Abuse... DET0063 Cross-Platform Behavioral Detection of P... DET0094 Cross-Platform Behavioral Detection of S... DET0287 Exploitation for Client Execution – cros... DET0290 Cross-Platform Detection of Cron Job Abu... +6 more

Installation (8)

DET0112 Boot or Logon Initialization Scripts Det... DET0240 Detection Strategy for Steal or Forge Au... DET0253 Detection of Systemd Service Creation or... DET0320 Detection of System Network Connections... DET0354 Behavior-chain detection for T1133 Exter... +3 more

Command & Control (14)

DET0027 Detection of Web Protocol-Based C2 Over... DET0039 Detection Strategy for Dynamic Resolutio... DET0060 Detect Ingress Tool Transfers via Behavi... DET0075 Internal Proxy Behavior via Lateral Host... DET0183 Detection Strategy for Lateral Tool Tran... +9 more

Actions on Objectives (9)

DET0104 Detect Modification of Authentication Pr... DET0127 Behavioral Detection of Masquerading Acr... DET0140 Behavioral Detection of Malicious File D... DET0168 Virtualization/Sandbox Evasion via Syste... DET0172 Behavior-chain, platform-aware detection... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

verdantbamboo

Type: Unknown Active
WARP PANDA UNC5221 tracked as Copy Fail 2 UNC3753 +7 more
Infrastructure 19 IOC(s)
50%
Domain
Cal.com securityonline.info Android.MagicAd Context.ai software.vendor +13
IPv4 Address
8.8.8.8
Artifacts (18)
Fondue.exe Next.js Node.js protobuf.js OneDrive.exe 95dc2289427ed29b8b996d0e3d1b78cb +12
Capability
50%
47 technique(s) 47 tool(s)/malware 40 CVE(s)
AGENTPSD Akira BRICKSTORM BRICKSTORM backdoor BSD variant of BRICKSTORM Backdoors CALENDAR Chaos +39
T1053.004
collection
T1005 T1213
command and control
T1071 T1071.001 T1071.004 T1090 +5
credential access
T1649
Victim
70%

Targeted Sectors

financial-services government critical-infrastructure healthcare energy defense telecommunications education hospitality information-technology legal-services manufacturing maritime pharmaceutical media construction retail gaming non-profit nuclear aerospace aviation mining utilities

Targeted Countries

CN IR US UA GB AE IN IT JP PL CA KR SG RO RU DE ES KP MX FR TW BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1592

Capability (Malware)

AGENTPSD Akira BRICKSTORM
3 Delivery

Capability (Techniques)

T1190 T1195 T1566

Capability (Malware)

AGENTPSD Akira BRICKSTORM
4 Exploitation

Capability (Malware)

AGENTPSD Akira BRICKSTORM
5 Installation

Capability (Malware)

AGENTPSD Akira BRICKSTORM
6 Command & Control

Capability (Malware)

AGENTPSD Akira BRICKSTORM
Leaving Threaticon

This link opens an external site that isn't part of the platform.