Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
woodgnat (threat actor)
Risk
79
Critical
15 techniques 50 tools/malware 3 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
›
4 Exploitation
4
T1059
Command and Scripting Interpreter execution
CVE CVE-2026-33017
CVE CVE-2026-54121
CVE CVE-2026-55255
›
5 Installation
5
T1552
Unsecured Credentials credential access
T1557
Adversary-in-the-Middle credential access
T1558.001
Golden Ticket credential access
T1133
External Remote Services persistence
T1505
Server Software Component persistence
›
6 Command & Control
1
T1021
Remote Services lateral movement
›
7 Actions on Objectives
6
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
T1055
Process Injection stealth
T1078
Valid Accounts stealth
Stage risk: Critical High Medium None

Tools & Malware (50)

8Base Akira Amadey Backdoor.Mistic Black Basta BlackCat BlackSuit Carbon ClickFix Cobalt Cobalt Strike Conti CrashFix Crisis Custom tools Dark DragonForce GitHub Global Hunter Infostealer Interlock KimJongRat Kimsuky KongTuke Langflow Leverage LockBit Lynx MLTBackdoor Microsoft Teams ModeloRAT Mythic Nokoyawa Ransomware PLAY Payload Phishing emails PowerShell Qilin Qilin Ransomware Ransomware variants Rhysida Royal Singularity Stealc Trojan Unknown certutil curl phishing

Indicators of Compromise (40)

Domain
driver-updater.net live.ong Temp.Zagros TEMP.Akapav TEMP.Jumper TEMP.Periscope TEMP.Hex Mallory.ai +16 more
Filename
cmd.exe Reg.exe Node.js EndpointDlp.dll meshsvc.exe meshagent.exe net.exe version.dll +2 more
SHA-256 Hash
b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17 3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be 9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470
IPv4 Address
45.207.216.55 7.2.6.1 104.200.67.46

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

32 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (14)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more
Exploitation (9)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Installation (20)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +15 more
Command & Control (6)
M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program +1 more
Actions on Objectives (16)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +11 more

Detection Coverage

15 strategies
5/7 stages covered

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Installation (5)

DET0144 Detect Forged Kerberos Golden Tickets (T... DET0296 Detect Adversary-in-the-Middle via Netwo... DET0354 Behavior-chain detection for T1133 Exter... DET0412 Detect Access or Search for Unsecured Cr... DET0547 Detection Strategy for T1505 - Server So...

Command & Control (1)

DET0269 Behavioral Detection Strategy for Remote...

Actions on Objectives (6)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0495 Detection Strategy for Financial Theft DET0508 Behavioral Detection of Process Injectio... DET0548 Detection Strategy for Exfiltration Over... +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

woodgnat

Type: Unknown Active
KongTuke Interlock Rhysida Akira 8Base +20 more
Infrastructure 27 IOC(s)
50%
Domain
driver-updater.net live.ong Temp.Zagros TEMP.Akapav TEMP.Jumper +19
IPv4 Address
45.207.216.55 7.2.6.1 104.200.67.46
Artifacts (13)
cmd.exe Reg.exe Node.js EndpointDlp.dll meshsvc.exe meshagent.exe +7
Capability
50%
15 technique(s) 50 tool(s)/malware 3 CVE(s)
8Base Akira Amadey Backdoor.Mistic Black Basta BlackCat BlackSuit Carbon +42
credential access
T1552 T1557 T1558.001
execution
T1059
exfiltration
T1048 T1567
impact
T1486 T1657
Victim
70%

Targeted Sectors

education financial-services government telecommunications defense healthcare critical-infrastructure media manufacturing retail aerospace non-profit information-technology hospitality aviation maritime nuclear entertainment gaming food-agriculture construction transportation

Targeted Countries

CN RU IN UA GB DE KP IR BR PK BY PL TW CA AU JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566

Capability (Malware)

8Base Akira Amadey
4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

8Base Akira Amadey
5 Installation

Capability (Malware)

8Base Akira Amadey
6 Command & Control

Capability (Techniques)

T1021

Capability (Malware)

8Base Akira Amadey
7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1486 T1657

Capability (Malware)

8Base Akira Amadey
Leaving Threaticon

This link opens an external site that isn't part of the platform.