Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
BITTER (threat actor)
Risk
91
Critical
30 techniques 52 tools/malware 9 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
6
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1588
Obtain Capabilities resource development
T1588.002
Tool resource development
T1608
Stage Capabilities resource development
T1608.001
Upload Malware resource development
›
3 Delivery
2
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
18
T1053
Scheduled Task/Job execution
T1053.005
Scheduled Task execution
T1059.003
Windows Command Shell execution
T1203
Exploitation for Client Execution execution
T1204
User Execution execution
T1204.002
Malicious File execution
T1559
Inter-Process Communication execution
T1559.002
Dynamic Data Exchange execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2012-0158
CVE CVE-2017-11882
CVE CVE-2017-12824
CVE CVE-2018-0798
CVE CVE-2018-0802
CVE CVE-2021-1732
CVE CVE-2021-28310
CVE CVE-2024-43572
CVE CVE-2025-8088
›
5 Installation
No data
›
6 Command & Control
8
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1071.004
DNS command and control
T1095
Non-Application Layer Protocol command and control
T1105
Ingress Tool Transfer command and control
T1568
Dynamic Resolution command and control
T1573
Encrypted Channel command and control
T1021
Remote Services lateral movement
›
7 Actions on Objectives
5
T1027
Obfuscated Files or Information stealth
T1027.013
Encrypted/Encoded File stealth
T1036
Masquerading stealth
T1036.004
Masquerade Task or Service stealth
T1660
T1660
Stage risk: Critical High Medium None

Tools & Malware (52)

APT38 Akira AndroRAT AppleJeus ArtraDownloader BitterRAT Bitter‑RAT BlackByte CVE-2012-0158 CVE-2017-11882 Carbanak Cobalt Confucius Custom malware Dark DarkHotel Global Guard Hafnium Kimsuky Let’s Encrypt Machete Maldoc Medusa MuddyWater Naikon Nexus ORPCBackdoor Octopus OilRig Open-source tools PLAY Payload Payload Phishing emails Poseidon PowerShell Remote access tools Scheduled Tasks SideWinder SlideRAT Spear-phishing Tasklist Trojan Void Winnti WmRAT ZxxZ ZxxZ Downloader curl phishing schtasks

Indicators of Compromise (40)

Domain
jacknwoods.com olmajhnservice.com woodstocktutors.com jbc.php blucollinsoutien.com sdf.php warsanservices.com function.The +15 more
Filename
mmc.exe shh.exe cmd.exe msuitl.tar msuitl.exe RdxFactory.exe dune64.bin conhost.exe +1 more
SHA-256 Hash
55f75724386dbe740c0b868da913af2c8b280335da4fde64e2300c776b79d4e8
IPv4 Address
173.254.204.72 95.169.180.122 46.229.55.63 99.83.154.118
URL
http:///svch.php?li=%computername%..%username% http:///svupfl.php?oi=%computername%_%username% http:///vbgf.php?mo=%computername%--%username%

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

27 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (18)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content +13 more
Command & Control (11)
M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1027 Password Policies M1030 Network Segmentation +6 more
Actions on Objectives (8)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

29 strategies
5/7 stages covered

Weaponization (6)

DET0824 Detection of Upload Malware DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool DET0892 Detection of Domains +1 more

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (9)

DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0441 Detection of Suspicious Scheduled Task C... +4 more

Command & Control (8)

DET0027 Detection of Web Protocol-Based C2 Over... DET0039 Detection Strategy for Dynamic Resolutio... DET0060 Detect Ingress Tool Transfers via Behavi... DET0269 Behavioral Detection Strategy for Remote... DET0273 Detection Strategy for Encrypted Channel... +3 more

Actions on Objectives (4)

DET0087 Encrypted or Encoded File Payload Detect... DET0117 Detection of Masqueraded Tasks or Servic... DET0127 Behavioral Detection of Masquerading Acr... DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

BITTER

Type: Unknown Active
T-APT-17 Offshore APT organization from South Asia Asia Bitter APT-C-08 +21 more
Infrastructure 30 IOC(s)
50%
Domain
jacknwoods.com olmajhnservice.com woodstocktutors.com jbc.php blucollinsoutien.com +18
IPv4 Address
173.254.204.72 95.169.180.122 46.229.55.63 99.83.154.118
URL
http:///svch.php?li=%computername%..%username% http:///svupfl.php?oi=%computername%_%username% http:///vbgf.php?mo=%computername%--%username%
Artifacts (10)
mmc.exe shh.exe cmd.exe msuitl.tar msuitl.exe RdxFactory.exe +4
Capability
71%
30 technique(s) 52 tool(s)/malware 9 CVE(s)
APT38 Akira AndroRAT AppleJeus ArtraDownloader BitterRAT Bitter‑RAT BlackByte +44
T1660
command and control
T1071 T1071.001 T1071.004 T1095 +3
execution
T1053 T1053.005 T1059.003 T1203 +4
initial access
T1566 T1566.001
Victim
70%

Targeted Sectors

government defense financial-services telecommunications healthcare energy education manufacturing media non-profit critical-infrastructure pharmaceutical aviation hospitality aerospace retail information-technology think-tank transportation mining chemical gaming legal-services nuclear entertainment oil-gas maritime food-agriculture construction utilities

Targeted Countries

SA CN US PK RU IR JP TW VN IN IL KR GB AU AE UA SG DE BY TR MX ES PL CA RO FR NG KP IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

APT38 Akira AndroRAT
3 Delivery

Capability (Techniques)

T1566 T1566.001

Capability (Malware)

APT38 Akira AndroRAT
4 Exploitation

Capability (Malware)

APT38 Akira AndroRAT
6 Command & Control

Capability (Malware)

APT38 Akira AndroRAT
Leaving Threaticon

This link opens an external site that isn't part of the platform.