Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
ta488 (threat actor)
Risk
59
High
4 techniques 42 tools/malware 1 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1592
Gather Victim Host Information reconnaissance
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
1
CVE CVE-2025-66376
›
5 Installation
1
T1557
Adversary-in-the-Middle credential access
›
6 Command & Control
1
T1114
Email Collection collection
›
7 Actions on Objectives
1
T1048
Exfiltration Over Alternative Protocol exfiltration
Stage risk: Critical High Medium None

Tools & Malware (42)

BEARDSHELL BRAIN Bart Beacon Chaos Covenant Exploit code Global Hive Hunter Infostealer JavaScript-based Malware Kazuar Leverage MATCHBOIL.V2 Nevada Nexus Open source tools Payload Payload Phishing emails Princess Proton Ramsay RoundCube Royal STOP Satori Scheduled Tasks Scout Shark Sofacy SpyPress Turla Unknown Void WildFire YARA Zebrocy ZimReaper evilginx2 phishing

Indicators of Compromise (40)

Domain
zimbra-metadata.com emailanalytics.com.ua mailnalysis.com analyticemailmeter.com zimbrastat.com zimbrasoft.com.ua 10.Imison 11.Hoomans +24 more
Email Address
c.laurent.ejfa@proton.me threatinsight@infosec.exchange j.moreau.epsc@proton.me liberty.insights@proton.me
SHA-256 Hash
1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874 b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Installation (7)
M1017 User Training M1030 Network Segmentation M1031 Network Intrusion Prevention M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +2 more
Command & Control (4)
M1032 Multi-factor Authentication M1041 Encrypt Sensitive Information M1047 Audit M1060 Out-of-Band Communications Channel
Actions on Objectives (6)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic +1 more

Detection Coverage

4 strategies
4/7 stages covered

Reconnaissance (1)

DET0826 Detection of Gather Victim Host Informat...

Installation (1)

DET0296 Detect Adversary-in-the-Middle via Netwo...

Command & Control (1)

DET0476 Email Collection via Local Email Access...

Actions on Objectives (1)

DET0131 Behavioral Detection Strategy for Exfilt...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

ta488

Type: Unknown Active
Void Blizzard Laundry Bear tracked as CL-STA-1114 Void +2 more
Infrastructure 32 IOC(s)
50%
Domain
zimbra-metadata.com emailanalytics.com.ua mailnalysis.com analyticemailmeter.com zimbrastat.com +27
Artifacts (8)
c.laurent.ejfa@proton.me threatinsight@infosec.exchange j.moreau.epsc@proton.me liberty.insights@proton.me 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf +2
Capability
50%
4 technique(s) 42 tool(s)/malware 1 CVE(s)
BEARDSHELL BRAIN Bart Beacon Chaos Covenant Exploit code Global +34
collection
T1114
credential access
T1557
exfiltration
T1048
reconnaissance
T1592
Victim
70%

Targeted Sectors

government defense energy education nuclear telecommunications media healthcare

Targeted Countries

United States of America Ukraine US RU UA GB CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1592

Capability (Malware)

BEARDSHELL BRAIN Bart
5 Installation

Capability (Techniques)

T1557

Capability (Malware)

BEARDSHELL BRAIN Bart
6 Command & Control

Capability (Techniques)

T1114

Capability (Malware)

BEARDSHELL BRAIN Bart
7 Actions on Objectives

Capability (Techniques)

T1048

Capability (Malware)

BEARDSHELL BRAIN Bart
Leaving Threaticon

This link opens an external site that isn't part of the platform.