Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
blackshadow (threat actor)
Risk
65
High
14 techniques 48 tools/malware 0 vulnerabilities 37 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
8
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1583.004
Server resource development
T1584
Compromise Infrastructure resource development
T1584.001
Domains resource development
T1584.003
Virtual Private Server resource development
T1584.004
Server resource development
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
No data
›
5 Installation
1
T1133
External Remote Services persistence
›
6 Command & Control
No data
›
7 Actions on Objectives
4
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
Stage risk: Critical High Medium None

Tools & Malware (48)

APT38 Akira Black Basta BlackByte BlackCat BlackSuit Carbanak Cobalt Conti DEADWOOD Dark Emissary Global Guard Hafnium Kimsuky Labyrinth Chollima Leverage LockBit Lynx Machete Medusa MuddyWater Mythic Naikon Nexus OceanLotus OilRig PLAY Payload Phishing campaigns Pink Ransomware variants Remote access tools Royal STOP Sednit SentinelOne Singularity Tsunami Turla Unknown Void Web Shells Wicked Winnti phishing route

Indicators of Compromise (37)

Domain
TEMP.Veles TEMP.Avengers TEMP.Hippo TMP.Lapis TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex +22 more
Email Address
rocke@live.cn
Filename
2439-1adadaa1e6579034.js c16f53c3-409df1246fc2628c.js 1356-c1c0cbeca59ade9b.js 8985-aac998da933c9fa0.js 5889-e987f21560aaf28e.js 2729-aeb73907a19f63b5.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Installation (5)
M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program
Actions on Objectives (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +5 more

Detection Coverage

14 strategies
4/7 stages covered

Weaponization (8)

DET0838 Detection of Virtual Private Server DET0854 Detection of Virtual Private Server DET0863 Detection of Domains DET0871 Detection of Server DET0874 Detection of Server +3 more

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Installation (1)

DET0354 Behavior-chain detection for T1133 Exter...

Actions on Objectives (4)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft DET0548 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
80%

blackshadow

Type: Criminal Sophistication: Medium First seen: 2021 Active
Sandworm Team tracked as Black Shadow a dark fleet is a ship +26 more
Infrastructure 30 IOC(s)
50%
Domain
TEMP.Veles TEMP.Avengers TEMP.Hippo TMP.Lapis TEMP.Zagros +25
Artifacts (7)
rocke@live.cn 2439-1adadaa1e6579034.js c16f53c3-409df1246fc2628c.js 1356-c1c0cbeca59ade9b.js 8985-aac998da933c9fa0.js 5889-e987f21560aaf28e.js +1
Capability
50%
14 technique(s) 48 tool(s)/malware
APT38 Akira Black Basta BlackByte BlackCat BlackSuit Carbanak Cobalt +40
exfiltration
T1048 T1567
impact
T1486 T1657
initial access
T1190
persistence
T1133
Victim
70%

Targeted Sectors

government financial-services telecommunications defense healthcare education manufacturing media non-profit energy critical-infrastructure information-technology pharmaceutical hospitality aerospace aviation retail think-tank transportation legal-services mining chemical gaming nuclear maritime entertainment construction oil-gas utilities food-agriculture

Targeted Countries

US IL CN IR RU SA GB IN UA AE VN JP PK AU TW KR DE KP BY SG TR PL CA RO MX ES LB FR NG IT AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2021-12-18

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

APT38 Akira Black Basta
3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

APT38 Akira Black Basta
5 Installation

Capability (Techniques)

T1133

Capability (Malware)

APT38 Akira Black Basta
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

APT38 Akira Black Basta
Leaving Threaticon

This link opens an external site that isn't part of the platform.