Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
y2k operators (threat actor)
Risk
87
Critical
42 techniques 59 tools/malware 5 vulnerabilities 39 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
12
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1106
Native API execution
T1204
User Execution execution
T1204.002
Malicious File execution
T1674
Input Injection execution
T1548.002
Bypass User Account Control privilege escalation
CVE CVE-2023-23397
CVE CVE-2023-38831
CVE CVE-2026-33825
CVE CVE-2026-50522
CVE CVE-2026-50751
›
5 Installation
12
T1539
Steal Web Session Cookie credential access
T1555.003
Credentials from Web Browsers credential access
T1012
Query Registry discovery
T1033
System Owner/User Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1217
Browser Information Discovery discovery
T1518
Software Discovery discovery
T1518.001
Security Software Discovery discovery
T1614
System Location Discovery discovery
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
11
T1005
Data from Local System collection
T1056.001
Keylogging collection
T1074.001
Local Data Staging collection
T1113
Screen Capture collection
T1123
Audio Capture collection
T1125
Video Capture collection
T1560
Archive Collected Data collection
T1071.001
Web Protocols command and control
T1071.004
DNS command and control
T1102.002
Bidirectional Communication command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
12
T1041
Exfiltration Over C2 Channel exfiltration
T1567.002
Exfiltration to Cloud Storage exfiltration
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1529
System Shutdown/Reboot impact
T1027.013
Encrypted/Encoded File stealth
T1036
Masquerading stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1070.004
File Deletion stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1497
Virtualization/Sandbox Evasion stealth
T1562.001
T1562.001
Stage risk: Critical High Medium None

Tools & Malware (59)

BRAIN BlackCat Breakthrough Chameleon Cicada3301 ClickFix Cobalt Conti DUCKTAIL Dark DragonForce DuckTail ExpressVPN Gentlemen GitHub Global Globe GoldDigger Guard Hancitor Hunters International Infostealer Leverage Lynx Matrix Millenium RAT Millennium RAT v4.* MuddyWater Nexus Payload Payload Phantom Stealer Phishing Kit Phishing campaigns Phoenix Phoenix System Pink PowerShell Proton Qilin Qilin Ransomware RansomHub STOP Scheduled Tasks ShinyEnigma SideWinder SilabRAT Social engineering tactics Spear-phishing Stealc TeamTNT Telegram Telegram channels Trojan Unknown VietCredCare WhatsApp XWorm builder trojanised phishing

Indicators of Compromise (39)

Domain
75877.mcdir.me 1.txt Sorint.Sec Ajina.Banker SideWinder.AntiBot.Script Forbes.ru salacti.com Mailbox.org +1 more
Filename
Builder.rar 2.vbs MsEdgeUpdate.exe Antivirus.exe Pack.zip powershell.exe svchost.exe Node.js +13 more
IPv4 Address
130.12.180.43 4.5.7.55 158.94.208.168 62.60.226.97
URL
http://75877.mcdir.me/files/2.vbs http://github.com/shienigma/Millenium-RAT http://milleniumrat.online http://gitea.com/shinyenigma/Millenium-RAT http://gitlab.com/shinyspace/millenium-rat

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Exploitation (14)
M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +9 more
Installation (8)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1032 Multi-factor Authentication +3 more
Command & Control (5)
M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit M1057 Data Loss Prevention
Actions on Objectives (13)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention +8 more

Detection Coverage

41 strategies
4/7 stages covered

Exploitation (7)

DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0388 Detection Strategy for T1548.002 – Bypas... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... +2 more

Installation (12)

DET0013 Detection of Local Browser Artifact Acce... DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0037 Detect Suspicious Access to Browser Cred... DET0043 Detection Strategy for System Location D... +7 more

Command & Control (11)

DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0197 Behavior-chain, platform-aware detection... +6 more

Actions on Objectives (11)

DET0046 Detection Strategy for T1497 Virtualizat... DET0087 Encrypted or Encoded File Payload Detect... DET0127 Behavioral Detection of Masquerading Acr... DET0140 Behavioral Detection of Malicious File D... DET0146 Detection of Data Destruction Across Pla... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

y2k operators

Type: Unknown Active
tracked as YoroTrooper version 2.4 SnappyClient Ghostwriter +2 more
Infrastructure 18 IOC(s)
50%
Domain
75877.mcdir.me 1.txt Sorint.Sec Ajina.Banker SideWinder.AntiBot.Script +4
IPv4 Address
130.12.180.43 4.5.7.55 158.94.208.168 62.60.226.97
URL
http://75877.mcdir.me/files/2.vbs http://github.com/shienigma/Millenium-RAT http://milleniumrat.online http://gitea.com/shinyenigma/Millenium-RAT http://gitlab.com/shinyspace/millenium-rat
Artifacts (21)
Builder.rar 2.vbs MsEdgeUpdate.exe Antivirus.exe Pack.zip powershell.exe +15
Capability
50%
42 technique(s) 59 tool(s)/malware 5 CVE(s)
BRAIN BlackCat Breakthrough Chameleon Cicada3301 ClickFix Cobalt Conti +51
T1562.001
collection
T1005 T1056.001 T1074.001 T1113 +3
command and control
T1071.001 T1071.004 T1102.002 T1105
credential access
T1539 T1555.003
Victim
70%

Targeted Sectors

financial-services defense government manufacturing aviation media healthcare retail telecommunications utilities transportation critical-infrastructure education hospitality energy

Targeted Countries

RU US SG AU VN BR CN FR IT RO EG NL IN KZ GB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Malware)

BRAIN BlackCat Breakthrough
5 Installation

Capability (Malware)

BRAIN BlackCat Breakthrough
6 Command & Control

Capability (Malware)

BRAIN BlackCat Breakthrough
7 Actions on Objectives

Capability (Malware)

BRAIN BlackCat Breakthrough
Leaving Threaticon

This link opens an external site that isn't part of the platform.