Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
CURIUM (threat actor)
Risk
96
Critical
39 techniques 54 tools/malware 4 vulnerabilities 14 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1598
Phishing for Information reconnaissance
T1598.003
Spearphishing Link reconnaissance
›
2 Weaponization
11
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1583.004
Server resource development
T1584
Compromise Infrastructure resource development
T1584.006
Web Services resource development
T1585
Establish Accounts resource development
T1585.001
Social Media Accounts resource development
T1585.002
Email Accounts resource development
T1608
Stage Capabilities resource development
T1608.004
Drive-by Target resource development
›
3 Delivery
5
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.003
Spearphishing via Service initial access
›
4 Exploitation
8
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1204
User Execution execution
T1204.002
Malicious File execution
CVE CVE-2025-49704
CVE CVE-2025-49706
CVE CVE-2025-53770
CVE CVE-2025-53771
›
5 Installation
12
T1016.001
Internet Connection Discovery discovery
T1033
System Owner/User Discovery discovery
T1049
System Network Connections Discovery discovery
T1082
System Information Discovery discovery
T1124
System Time Discovery discovery
T1505
Server Software Component persistence
T1505.001
SQL Stored Procedures persistence
T1505.002
Transport Agent persistence
T1505.003
Web Shell persistence
T1505.004
IIS Components persistence
T1505.005
Terminal Services DLL persistence
T1505.006
vSphere Installation Bundles persistence
›
6 Command & Control
1
T1005
Data from Local System collection
›
7 Actions on Objectives
4
T1041
Exfiltration Over C2 Channel exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1048.002
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol exfiltration
T1338
T1338
Stage risk: Critical High Medium None

Tools & Malware (54)

APT38 ASPXSpy BUSHWALK BlackByte China Chopper Cobalt Crimson Epic FRAMESTING FrostyGoop GLASSTOKEN Global Globe Guard Hafnium Hunter IMAPLoader Imperial Kitten Kimsuky LIGHTWIRE Liderc Line Runner Malicious files Medusa Microsoft Teams Neo-reGeorg OilRig OwaAuth PHASEJAM PHPsert PULSECHECK Payload Phishing campaigns Phishing emails PowerShell RAPIDPULSE ReGeorg SEASHARPEE STOP SUPERNOVA SentinelOne Smoke Sandstorm SnappyTCP Spear-phishing StandardKeyboard SupplyChainScripts Unknown WIREFIRE Web Shell Web Shells WebShell Webshells phishing reGeorg

Indicators of Compromise (14)

Domain
spinstall0.aspx AuditReport.jspx iisstart.aspx TEMP.Veles microsoft-threat-actor-naming.md Curiumpharma.com pickers.aspx error4.aspx +1 more
Filename
powershell.exe cmd.exe w3wp.exe
MD5 Hash
46fd0d415d6f1ab2b7c5ed600b63c59c 8b864ea2c8879287e5f14e59784ce899

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

25 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (2)
M1017 User Training M1054 Software Configuration
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (11)
M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more
Installation (8)
M1018 User Account Management M1024 Restrict Registry Permissions M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program +3 more
Command & Control (1)
M1057 Data Loss Prevention
Actions on Objectives (6)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic +1 more

Detection Coverage

38 strategies
7/7 stages covered

Reconnaissance (2)

DET0823 Detection of Phishing for Information DET0878 Detection of Spearphishing Link

Weaponization (11)

DET0825 Detection of Drive-by Target DET0835 Detection of Email Accounts DET0838 Detection of Virtual Private Server DET0839 Detection of Stage Capabilities DET0851 Detection of Social Media Accounts +6 more

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0115 Detection Strategy for Spearphishing via... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0294 User Execution – Malicious File via down... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri...

Installation (12)

DET0068 Detection Strategy for T1505.004 - Malic... DET0093 Behavioral Detection of User Discovery v... DET0151 Behavior-chain, platform-aware detection... DET0166 Detection Strategy for T1505.002 - Trans... DET0181 Detection Strategy for SQL Stored Proced... +7 more

Command & Control (1)

DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (3)

DET0131 Behavioral Detection Strategy for Exfilt... DET0348 Detection Strategy for Exfiltration Over... DET0512 Detection of Exfiltration Over Asymmetri...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

CURIUM

Type: Unknown Active
Crimson Sandstorm TA456 Tortoise Shell Yellow Liderc IMPERIAL KITTEN +8 more
Infrastructure 9 IOC(s)
50%
Domain
spinstall0.aspx AuditReport.jspx iisstart.aspx TEMP.Veles microsoft-threat-actor-naming.md +4
Artifacts (5)
powershell.exe cmd.exe w3wp.exe 46fd0d415d6f1ab2b7c5ed600b63c59c 8b864ea2c8879287e5f14e59784ce899
Capability
69%
39 technique(s) 54 tool(s)/malware 4 CVE(s)
APT38 ASPXSpy BUSHWALK BlackByte China Chopper Cobalt Crimson Epic +46
T1338
collection
T1005
discovery
T1016.001 T1033 T1049 T1082 +1
execution
T1059 T1059.001 T1204 T1204.002
Victim
70%

Targeted Sectors

defense government financial-services energy healthcare pharmaceutical telecommunications media non-profit legal-services transportation nuclear maritime aerospace critical-infrastructure education

Targeted Countries

IR UA SA US IL CN NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1598 T1598.003

Capability (Malware)

APT38 ASPXSpy BUSHWALK
2 Weaponization

Capability (Malware)

APT38 ASPXSpy BUSHWALK
3 Delivery

Capability (Malware)

APT38 ASPXSpy BUSHWALK
4 Exploitation

Capability (Malware)

APT38 ASPXSpy BUSHWALK
5 Installation

Capability (Malware)

APT38 ASPXSpy BUSHWALK
6 Command & Control

Capability (Techniques)

T1005

Capability (Malware)

APT38 ASPXSpy BUSHWALK
7 Actions on Objectives

Capability (Techniques)

T1041 T1048 T1048.002

Capability (Malware)

APT38 ASPXSpy BUSHWALK
Leaving Threaticon

This link opens an external site that isn't part of the platform.