Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
APT22 (threat actor)
Risk
69
High
14 techniques 48 tools/malware 0 vulnerabilities 12 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566.002
Spearphishing Link initial access
›
4 Exploitation
2
T1059
Command and Scripting Interpreter execution
T1059.003
Windows Command Shell execution
›
5 Installation
4
T1003
OS Credential Dumping credential access
T1003.001
LSASS Memory credential access
T1046
Network Service Discovery discovery
T1137
Office Application Startup persistence
›
6 Command & Control
1
T1071
Application Layer Protocol command and control
›
7 Actions on Objectives
6
T1553
Subvert Trust Controls defense impairment
T1553.006
Code Signing Policy Modification defense impairment
T1055
Process Injection stealth
T1078
Valid Accounts stealth
T1078.001
Default Accounts stealth
T1646
T1646
Stage risk: Critical High Medium None

Tools & Malware (48)

APT38 Akira AppleJeus BLINDINGCAN Backdoor.Nidiran Backdoors BlackByte BlackByte Ransomware Carbanak Carbanak malware Chimera China Chopper Cobalt Confucius Conti Custom malware Dark DarkHotel Global Guard Hafnium Karma Kimsuky Machete Medusa Moonstone Sleet MuddyWater Naikon Nexus Nidiran Octopus OilRig Open-source tools PLAY PlugX PoisonIvy Poseidon RedCurl Remote access tools SideWinder Spear-phishing Stolen code‑signing certificates (e.g., China Chopper), "Signed Credential Dumper" Trojan Turla Void Winnti Zero-day exploits phishing

Indicators of Compromise (12)

Domain
Backdoor.Nidiran TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex TEMP.hermit TEMP.Reaper +3 more
Email Address
rocke@live.cn

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (5)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1054 Software Configuration
Exploitation (9)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Installation (14)
M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +9 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (14)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1024 Restrict Registry Permissions +9 more

Detection Coverage

13 strategies
5/7 stages covered

Delivery (1)

DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0516 Behavioral Detection of Command and Scri...

Installation (4)

DET0234 Credential Dumping via Sensitive Memory... DET0363 Detection of Credential Dumping from LSA... DET0376 Behavioral Detection Strategy for Networ... DET0398 Detect Office Startup-Based Persistence...

Command & Control (1)

DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (5)

DET0452 Detect Subversion of Trust Controls via... DET0465 Detection of Default Account Abuse Acros... DET0508 Behavioral Detection of Process Injectio... DET0523 Detect Code Signing Policy Modification... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
70%

APT22

Type: Nation-State Active
G0039 Suckfly BRONZE OLIVE Group 46 tracked as +23 more
Infrastructure 11 IOC(s)
50%
Domain
Backdoor.Nidiran TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope +6
Artifacts (1)
rocke@live.cn
Capability
50%
14 technique(s) 48 tool(s)/malware
APT38 Akira AppleJeus BLINDINGCAN Backdoor.Nidiran Backdoors BlackByte BlackByte Ransomware +40
T1646
command and control
T1071
credential access
T1003 T1003.001
defense impairment
T1553 T1553.006
Victim
70%

Targeted Sectors

government financial-services defense telecommunications healthcare education manufacturing media non-profit energy critical-infrastructure pharmaceutical aviation hospitality information-technology retail aerospace transportation gaming think-tank mining chemical maritime entertainment legal-services nuclear oil-gas construction utilities

Targeted Countries

CN US RU IR UA IN VN JP IL GB AU SA PK TW AE KR TR SG DE BY MX ES PL CA RO FR NG KP IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.002

Capability (Malware)

APT38 Akira AppleJeus
4 Exploitation

Capability (Techniques)

T1059 T1059.003

Capability (Malware)

APT38 Akira AppleJeus
5 Installation

Capability (Malware)

APT38 Akira AppleJeus
6 Command & Control

Capability (Techniques)

T1071

Capability (Malware)

APT38 Akira AppleJeus
Leaving Threaticon

This link opens an external site that isn't part of the platform.