Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
TeamSpy Crew (threat actor)
Risk
90
Critical
19 techniques 51 tools/malware 19 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
21
T1059.003
Windows Command Shell execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2013-3893
CVE CVE-2014-0322
CVE CVE-2014-1776
CVE CVE-2014-4114
CVE CVE-2015-1701
CVE CVE-2015-2545
CVE CVE-2015-5119
CVE CVE-2015-5122
CVE CVE-2017-11882
CVE CVE-2017-8759
CVE CVE-2018-0798
CVE CVE-2018-8174
CVE CVE-2019-13720
CVE CVE-2019-2215
CVE CVE-2021-28310
CVE CVE-2021-35211
CVE CVE-2023-38831
CVE CVE-2024-21412
CVE CVE-2104-4114
›
5 Installation
4
T1003.002
Security Account Manager credential access
T1120
Peripheral Device Discovery discovery
T1133
External Remote Services persistence
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
2
T1021
Remote Services lateral movement
T1021.004
SSH lateral movement
›
7 Actions on Objectives
10
T1112
Modify Registry defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1027.002
Software Packing stealth
T1036
Masquerading stealth
T1055
Process Injection stealth
T1055.004
Asynchronous Procedure Call stealth
T1070.004
File Deletion stealth
T1078
Valid Accounts stealth
T1574.001
DLL stealth
T9000
T9000
Stage risk: Critical High Medium None

Tools & Malware (51)

Aurora BLINDINGCAN trojan family BlackEnergy Buhtrap Cobalt Confucius Dark DarkHotel GitHub Global JAVA RATs Jackal Legitimate Software Lynx Malicious TeamViewer versions Malwarebytes Matrix Mimikatz MiniDuke Modified Remote Utilities MuddyWater Naikon Nexus Nitro OceanLotus OilRig Phishing emails PlugX Poison Ivy Poseidon Remote Manipulator System Remote Manipulator System / RMS Sednit Seldon 1.7 framework Shamoon SideWinder Snake Sofacy Taidoor TeamSpy TeamTNT TeamViewer TeamViewer (malicious variant) Trojan Tsunami Turla Unknown VICEROY Void Winnti phishing

Indicators of Compromise (39)

Domain
demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +16 more
Filename
cmd.exe msimg32.dll winspool.drv vp8encoder.dll NTAdmin.exe migwiz.exe cryptbase.dll rutserv.exe
MD5 Hash
16b4ebfdf74db8f730f2fb4d03e86d27 8c4e9016b9b4db809dd312f971a275b1 60154c16e8d06c1519188d396c713837 34A1E9FCC84ADC4AB2EC364845F64220 3dad56414442ca61ef6810fdf48d5528 5A6EFA2921D3174BB9808FA3A3400D13
IPv4 Address
1.1.1.1

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (5)
M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software
Installation (9)
M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +4 more
Command & Control (6)
M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program +1 more
Actions on Objectives (19)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +14 more

Detection Coverage

18 strategies
5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0514 Detection Strategy for Exploitation for...

Installation (4)

DET0085 Credential Dumping from SAM via Registry... DET0354 Behavior-chain detection for T1133 Exter... DET0365 Detect Registry and Startup Folder Persi... DET0491 Peripheral Device Enumeration via System...

Command & Control (2)

DET0269 Behavioral Detection Strategy for Remote... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (9)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0100 Behavioral Detection of Asynchronous Pro... DET0127 Behavioral Detection of Masquerading Acr... DET0140 Behavioral Detection of Malicious File D... DET0201 Detection Strategy for Hijack Execution... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
70%

TeamSpy Crew

Type: Nation-State Active
SIG39 TeamSpy Team Bear Anger Bear IRON LYRIC +36 more
Infrastructure 25 IOC(s)
50%
Domain
demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +19
IPv4 Address
1.1.1.1
Artifacts (14)
cmd.exe msimg32.dll winspool.drv vp8encoder.dll NTAdmin.exe migwiz.exe +8
Capability
51%
19 technique(s) 51 tool(s)/malware 19 CVE(s)
Aurora BLINDINGCAN trojan family BlackEnergy Buhtrap Cobalt Confucius Dark DarkHotel +43
T9000
credential access
T1003.002
defense impairment
T1112
discovery
T1120
Victim
70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications aerospace media education maritime manufacturing healthcare critical-infrastructure think-tank information-technology utilities hospitality pharmaceutical oil-gas chemical gaming retail transportation mining legal-services nuclear entertainment

Targeted Countries

middle_east europe central_asia US CN RU IN JP GB KR DE IR SA TW UA IL PK KZ VN FR BY CA TR PL AU KP AE MX IT SY SG NL BR ES IQ RO LB EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001
4 Exploitation

Capability (Techniques)

T1059.003 T1068
5 Installation
6 Command & Control

Capability (Techniques)

T1021 T1021.004
7 Actions on Objectives

Capability (Techniques)

T1041
Leaving Threaticon

This link opens an external site that isn't part of the platform.