Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
settra (threat actor)
Risk
79
Critical
25 techniques 47 tools/malware 1 vulnerabilities 19 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
5
T1047
Windows Management Instrumentation execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1548.002
Bypass User Account Control privilege escalation
CVE CVE-2025-7771
›
5 Installation
4
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1135
Network Share Discovery discovery
›
6 Command & Control
4
T1005
Data from Local System collection
T1039
Data from Network Shared Drive collection
T1530
Data from Cloud Storage collection
T1071
Application Layer Protocol command and control
›
7 Actions on Objectives
11
T1041
Exfiltration Over C2 Channel exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1567.002
Exfiltration to Cloud Storage exfiltration
T1486
Data Encrypted for Impact impact
T1070.004
File Deletion stealth
T1078
Valid Accounts stealth
T1078.001
Default Accounts stealth
T1078.003
Local Accounts stealth
T1078.004
Cloud Accounts stealth
T0560
T0560
T1562
T1562
Stage risk: Critical High Medium None

Tools & Malware (47)

Advanced IP Scanner Alphv AnyDesk Babuk Babuk Ransomware BlackCat BlackCat Crisis Custom-built malware Dark Embargo Gentlemen GitHub Global Group Policy Guard INC Ransomware Icarus Infostealer Infostealer Malware Infostealer malware KryBit Leverage LockBit Mimikatz Netscan Nmap PAExec PLAY Payload Persistence mechanisms Phishing emails PowerShell PsExec Qilin Qilin Ransomware Ruler SentinelOne Silence SpyPress Telegram Unknown Wevtutil Windows Command Shell ZimReaper phishing procdump

Indicators of Compromise (19)

Domain
Win.GentlemenCryptAhnLab Ransomwhere.org clc-tn.com petradiamonds.com orion4value.com intrix.cyber NoteREADME-GENTLEMEN.txtDropped ThrottleBlood.sysCVE +2 more
Email Address
incident@moxfive.com
Filename
All.exe Allpatch2.exe ThrottleStop.sys DriverThrottleStop.sys KillerAll.exe ThrottleBlood.sys
URL
http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion/leaks

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (10)
M1018 User Account Management M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program +5 more
Installation (1)
M1028 Operating System Configuration
Command & Control (8)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic +3 more
Actions on Objectives (13)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +8 more

Detection Coverage

23 strategies
5/7 stages covered

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0202 Behavioral Detection of Windows Command... DET0364 Behavioral Detection Strategy for WMI Ex... DET0388 Detection Strategy for T1548.002 – Bypas... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (4)

DET0034 Detection of Adversarial Process Discove... DET0182 Behavior-chain detection for T1135 Netwo... DET0370 Recursive Enumeration of Files and Direc... DET0525 System Discovery via Native and Remote U...

Command & Control (4)

DET0380 Detection of Local Data Collection Prior... DET0410 Detection Strategy for Data from Network... DET0444 Detection of Command and Control Over Ap... DET0484 Multi-Platform Cloud Storage Exfiltratio...

Actions on Objectives (9)

DET0140 Behavioral Detection of Malicious File D... DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over... DET0407 Detection of Local Account Abuse for Ini... DET0465 Detection of Default Account Abuse Acros... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
80%

settra

Type: Criminal Sophistication: Medium First seen: 2026 Active
tracked as Seth Ra Kitty Country Motors +7 more
Infrastructure 12 IOC(s)
50%
Domain
Win.GentlemenCryptAhnLab Ransomwhere.org clc-tn.com petradiamonds.com orion4value.com +5
URL
http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion/leaks
Artifacts (7)
incident@moxfive.com All.exe Allpatch2.exe ThrottleStop.sys DriverThrottleStop.sys KillerAll.exe +1
Capability
50%
25 technique(s) 47 tool(s)/malware 1 CVE(s)
Advanced IP Scanner Alphv AnyDesk Babuk Babuk Ransomware BlackCat BlackCat Crisis +39
T0560 T1562
collection
T1005 T1039 T1530
command and control
T1071
discovery
T1057 T1082 T1083 T1135
Victim
70%

Targeted Sectors

defense financial-services manufacturing retail healthcare government energy food-agriculture education construction information-technology transportation critical-infrastructure

Targeted Countries

US TW GB DE BR KR SG CA FR SA RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

Resources

government

First Seen

2026-06-02

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

Advanced IP Scanner Alphv AnyDesk
4 Exploitation

Capability (Malware)

Advanced IP Scanner Alphv AnyDesk
5 Installation

Capability (Techniques)

T1057 T1082 T1083 T1135

Capability (Malware)

Advanced IP Scanner Alphv AnyDesk
6 Command & Control

Capability (Techniques)

T1005 T1039 T1530 T1071

Capability (Malware)

Advanced IP Scanner Alphv AnyDesk
7 Actions on Objectives

Capability (Malware)

Advanced IP Scanner Alphv AnyDesk
Leaving Threaticon

This link opens an external site that isn't part of the platform.