Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Pitty Tiger (threat actor)

Risk

Medium

3 techniques 48 tools/malware 0 vulnerabilities 20 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588

Obtain Capabilities resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (48)

APT38 Akira AppleJeus Aurora BADAUDIO BARIUM BlackByte BrutPOS Carbanak Cobalt Confucius Custom malware Dark DarkHotel GitHub Guard Hafnium Infostealer Karma Kimsuky Machete Medusa Mimikatz Mirage Moonstone Sleet MuddyWater Naikon Nexus Octopus OilRig Open-source tools PLAY Paladin RAT PittyTiger PoisonIvy Poseidon RedCurl Regin Remote access tools SideWinder Trojan Turla Unknown Void Winnti gsecdump paladin phishing

Indicators of Compromise (20)

Domain

Win.Trojan.Agent Temp.Pittytiger TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex TEMP.hermit TEMP.Reaper +4 more

Email Address

rocke@live.cn

SHA-256 Hash

9A10916AD0F43FA3376C2E54FD5CFDD06D684B3A19895ED4107FAF9F3313DCDA 003315B0AEA2FCB9F77D29223DD8947D0E6792B3A0227E054BE8EB2A11F443D9 14BFDA4A4ACA1276388702D0FB7629AF120FF34C1ACDEB7613815F2981C99832 508909C8A00026C904F52099DD62BBF4062B4E8E40FC0601BD9E13570514B4F5 7170A07BCB5B0467A75CBD17A1A1877AEC3C8EA43C45D3BED6AB5E6C95A62713 E28EABEB678AFB5E172F4127C5692E742809FD86DFA8478C1DC6F9C13B2A8E5F 015FBC0B216D197136DF8692B354BF2FC7BD6EB243E73283D861A4DBBB81A751

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Actions on Objectives (8)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +3 more

Detection Coverage

3 strategies

3/7 stages covered

Weaponization (1)

DET0850 Detection of Obtain Capabilities

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Actions on Objectives (1)

DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

70%

Pitty Tiger

Type: Nation-State Active

Pitty Panda Pitty Tiger Links to Skyipot Comment Crew Mirage +33 more

Infrastructure 12 IOC(s)

50%

Domain

Win.Trojan.Agent Temp.Pittytiger TEMP.Zagros TEMP.Jumper TEMP.Periscope +7

Artifacts (8)

rocke@live.cn 9A10916AD0F43FA3376C2E54FD5CFDD06D684B3A19895ED4107FAF9F3313DCDA 003315B0AEA2FCB9F77D29223DD8947D0E6792B3A0227E054BE8EB2A11F443D9 14BFDA4A4ACA1276388702D0FB7629AF120FF34C1ACDEB7613815F2981C99832 508909C8A00026C904F52099DD62BBF4062B4E8E40FC0601BD9E13570514B4F5 7170A07BCB5B0467A75CBD17A1A1877AEC3C8EA43C45D3BED6AB5E6C95A62713 +2

Capability

51%

3 technique(s) 48 tool(s)/malware

APT38 Akira AppleJeus Aurora BADAUDIO BARIUM BlackByte BrutPOS +40

initial access

T1566.001

resource development

T1588

stealth

T1078

Victim

70%

Targeted Sectors

government financial-services telecommunications defense healthcare education manufacturing media non-profit energy critical-infrastructure pharmaceutical aviation hospitality aerospace retail information-technology think-tank transportation mining chemical gaming legal-services nuclear entertainment oil-gas maritime construction utilities

Targeted Countries

IN US CN RU IL IR VN JP GB AU SA PK TW AE UA SG KR DE BY TR MX ES PL CA RO FR NG KP IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588

Capability (Malware)

APT38 Akira AppleJeus

Infrastructure

Win.Trojan.Agent Temp.Pittytiger TEMP.Zagros

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

APT38 Akira AppleJeus

Infrastructure

Win.Trojan.Agent Temp.Pittytiger TEMP.Zagros