Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
PassCV (threat actor)
Risk
84
Critical
55 techniques 68 tools/malware 1 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
1
T1588.002
Tool resource development
›
3 Delivery
3
T1190
Exploit Public-Facing Application initial access
T1195.002
Compromise Software Supply Chain initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
9
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.004
Unix Shell execution
T1203
Exploitation for Client Execution execution
T1569.002
Service Execution execution
T1546.008
Accessibility Features privilege escalation
CVE CVE-2025-59374
›
5 Installation
13
T1003.001
LSASS Memory credential access
T1110.002
Password Cracking credential access
T1016
System Network Configuration Discovery discovery
T1033
System Owner/User Discovery discovery
T1046
Network Service Discovery discovery
T1049
System Network Connections Discovery discovery
T1083
File and Directory Discovery discovery
T1135
Network Share Discovery discovery
T1133
External Remote Services persistence
T1136.001
Local Account persistence
T1543.003
Windows Service persistence
T1547
Boot or Logon Autostart Execution persistence
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
12
T1005
Data from Local System collection
T1056.001
Keylogging collection
T1008
Fallback Channels command and control
T1071.001
Web Protocols command and control
T1071.002
File Transfer Protocols command and control
T1071.004
DNS command and control
T1090
Proxy command and control
T1102.001
Dead Drop Resolver command and control
T1104
Multi-Stage Channels command and control
T1105
Ingress Tool Transfer command and control
T1568.002
Domain Generation Algorithms command and control
T1021.001
Remote Desktop Protocol lateral movement
›
7 Actions on Objectives
18
T1553.002
Code Signing defense impairment
T1486
Data Encrypted for Impact impact
T1496
Resource Hijacking impact
T1036.004
Masquerade Task or Service stealth
T1055
Process Injection stealth
T1070.003
Clear Command History stealth
T1070.004
File Deletion stealth
T1078
Valid Accounts stealth
T1197
BITS Jobs stealth
T1218.001
Compiled HTML File stealth
T1218.011
Rundll32 stealth
T1480.001
Environmental Keying stealth
T1542.003
Bootkit stealth
T1574.001
DLL stealth
T1574.006
Dynamic Linker Hijacking stealth
T1070.001
T1070.001
T1100
T1100
T1574.002
T1574.002
Stage risk: Critical High Medium None

Tools & Malware (68)

ASPXSpy BARIUM BITS BLACKCOFFEE BLINDINGCAN Bahamut BirdCall Carberp RAT China Chopper Cobalt Cobalt Strike Conpee DEPLOYLOG Derusbi Derusbi Emotet Emotet Etso Excalibur Expand Gh0st Ghost RAT GitHub Global Guard Havex RAT HenBox Jynxkit Kimsuky Kitkiot Leverage Mango MoonBounce NetCommander NetWire RC PHOTO PRIVATELOG PlugX PowerPool ROCKBOOT Rootkit Royal Runxx Sabre ShadowPad Spear-phishing Speculoos Backdoor Spyder Loader Stealth Mango StoneV5 TreadStone Trojan WAVESHAPER WINNKIT Webshells Wicked Winnti Winnti Loader Winnti Rootkit Winnti malware YARA ZxShell dnsenum gh0st RAT icmp_shell njRAT phishing rdp_crk

Indicators of Compromise (39)

Domain
Academia.edu aqdrmf-rymPhb-ibnC6b.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-SfQLQb-bMcfAe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-OWB6Me.aqdrmf O68mGe-xl07Ob-ibnC6b-OWXEXe-r08add.aqdrmf O68mGe-xl07Ob-ibnC6b-OWXEXe-E6eRQd.aqdrmf O68mGe-xl07Ob-ibnC6b-OWXEXe-gk6SMd.aqdrmf +31 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

37 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (14)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1035 Limit Access to Resource Over Network +9 more
Installation (16)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1025 Privileged Process Integrity M1026 Privileged Account Management +11 more
Command & Control (13)
M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +8 more
Actions on Objectives (23)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +18 more

Detection Coverage

52 strategies
6/7 stages covered

Weaponization (1)

DET0852 Detection of Tool

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att... DET0309 Compromised software/update chain (insta...

Exploitation (8)

DET0033 Detection Strategy for Accessibility Fea... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0364 Behavioral Detection Strategy for WMI Ex... DET0384 Behavioral Detection of Unix Shell Execu... +3 more

Installation (13)

DET0093 Behavioral Detection of User Discovery v... DET0105 Post-Credential Dump Password Cracking D... DET0182 Behavior-chain detection for T1135 Netwo... DET0195 Behavioral Detection of System Network C... DET0274 Boot or Logon Autostart Execution Detect... +8 more

Command & Control (12)

DET0027 Detection of Web Protocol-Based C2 Over... DET0058 Detection Strategy for Web Service: Dead... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0228 Detect Multi-Stage Command and Control C... +7 more

Actions on Objectives (15)

DET0098 Detect abuse of Windows BITS Jobs for do... DET0117 Detection of Masqueraded Tasks or Servic... DET0140 Behavioral Detection of Malicious File D... DET0150 Detection Strategy for File Creation or... DET0165 Behavioral Detection of Command History... +10 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
50%

PassCV

Type: Unknown Active
TG-3279 Winnti Umbrella China Cracking Group tracked as indicating active exploitation +4 more
Infrastructure 39 IOC(s)
50%
Domain
Academia.edu aqdrmf-rymPhb-ibnC6b.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-SfQLQb-bMcfAe-gk6SMd.aqdrmf aqdrmf-rymPhb-ibnC6b-OWXEXe-OWB6Me.aqdrmf +34
Capability
54%
55 technique(s) 68 tool(s)/malware 1 CVE(s)
ASPXSpy BARIUM BITS BLACKCOFFEE BLINDINGCAN Bahamut BirdCall Carberp RAT +60
T1070.001 T1100 T1574.002
collection
T1005 T1056.001
command and control
T1008 T1071.001 T1071.002 T1071.004 +5
credential access
T1003.001 T1110.002
Victim
70%

Targeted Sectors

gaming financial-services government energy pharmaceutical telecommunications media manufacturing healthcare defense retail utilities aerospace construction aviation education

Targeted Countries

CN US IN FR IT JP KR PK TW TR NG GB RU DE BR SG KZ NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.002

Capability (Malware)

ASPXSpy BARIUM BITS
3 Delivery

Capability (Techniques)

T1190 T1195.002 T1566.001

Capability (Malware)

ASPXSpy BARIUM BITS
4 Exploitation

Capability (Malware)

ASPXSpy BARIUM BITS
5 Installation

Capability (Malware)

ASPXSpy BARIUM BITS
6 Command & Control

Capability (Malware)

ASPXSpy BARIUM BITS
7 Actions on Objectives

Capability (Techniques)

T1486 T1496

Capability (Malware)

ASPXSpy BARIUM BITS
Leaving Threaticon

This link opens an external site that isn't part of the platform.