Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Scattered Lapsus Hunters (threat actor)
Risk
90
Critical
28 techniques 65 tools/malware 3 vulnerabilities 19 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
3
T1589
Gather Victim Identity Information reconnaissance
T1592
Gather Victim Host Information reconnaissance
T1595
Active Scanning reconnaissance
›
2 Weaponization
No data
›
3 Delivery
3
T1199
Trusted Relationship initial access
T1566
Phishing initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
3
CVE CVE-2025-14174
CVE CVE-2025-61882
CVE CVE-2025-61884
›
5 Installation
2
T1528
Steal Application Access Token credential access
T1555
Credentials from Password Stores credential access
›
6 Command & Control
2
T1213
Data from Information Repositories collection
T1090
Proxy command and control
›
7 Actions on Objectives
18
T1041
Exfiltration Over C2 Channel exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1078
Valid Accounts stealth
T1041 Exfiltration Over Command & Control Channel
T1041 Exfiltration Over Command & Control Channel
T1055.001 Process Injection
T1055.001 Process Injection
T1078 Valid Accounts
T1078 Valid Accounts
T1090 Connection Proxy
T1090 Connection Proxy
T1190 Exploit Public-Facing Application
T1190 Exploit Public-Facing Application
T1203 Exploitation for Client Execution
T1203 Exploitation for Client Execution
T1213 Data from Information Repositories
T1213 Data from Information Repositories
T1528 Steal Application Access Token
T1528 Steal Application Access Token
T1555.001 Credentials from Password Stores
T1555.001 Credentials from Password Stores
T1566 Phishing
T1566 Phishing
T1566.002 Spearphishing Link
T1566.002 Spearphishing Link
T1567 Exfiltration Over Web Service
T1567 Exfiltration Over Web Service
T1589 Gather Victim Identity Information
T1589 Gather Victim Identity Information
T1592 Gather Victim Host Information
T1592 Gather Victim Host Information
T1595 Active Scanning
T1595 Active Scanning
Stage risk: Critical High Medium None

Tools & Malware (65)

Alien BPFDoor Backdoor.Syskit Beacon BiBi BiBi wiper Chaos Cl0p Ransomware (for destructive sabotage) Cl0p ransomware ClickFix Crimson Custom Wiper Malware Custom malware Dark Evilginx2 GOLDVEIN.JAVA Gentlemen Global Gremlin Guard Handala Hatef Hunter Imperial Kitten Infostealer Infostealer SHA.exe Infostealer/Sha.exe/Sha432.exe Infostealer/stereoversioncontrol.exe Karma Klopatra Leverage Mimikatz MuddyWater Nexus No-Justice Payload Payload Phishing kits Poison Frog PowerShell RawDisk SAGE SAGEGIFT SAGELEAF SAGEWAVE STOP Salesforce APIs Salesloft Drift Integration Splinter Telegram Telegram channels TruffleHog Unknown Void Web Shell Web Shells WildFire Wiper malware Zero-day exploits evilginx2 get-logon-history.ps1 ifconfig netstat phishing reGeorg

Indicators of Compromise (19)

Domain
weblogic.t3.srvr.ServerRuntime FalconFeeds.io DataBreaches.net GOLDVEIN.JAVA navvSetId.iHelp OA.jsp java.net.Socket cl.getDeclaredMethod
Email Address
support@pubstorm.com support@pubstorm.net ops@rescana.com Info@rescana.com
Filename
cmd.exe comsvcs.dll
IPv4 Address
200.107.207.26 104.194.11.200 161.97.99.49 8.8.8.8 162.55.17.215

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Delivery (9)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1030 Network Segmentation M1031 Network Intrusion Prevention +4 more
Installation (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies +2 more
Command & Control (10)
M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +5 more
Actions on Objectives (11)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +6 more

Detection Coverage

13 strategies
5/7 stages covered

Reconnaissance (3)

DET0826 Detection of Gather Victim Host Informat... DET0830 Detection of Active Scanning DET0841 Detection of Gather Victim Identity Info...

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0488 Detect abuse of Trusted Relationships (t...

Installation (2)

DET0430 Detect Credentials Access from Password... DET0515 Detection Strategy for T1528 - Steal App...

Command & Control (2)

DET0413 Abuse of Information Repositories for Da... DET0445 Detection of Proxy Infrastructure Setup...

Actions on Objectives (3)

DET0348 Detection Strategy for Exfiltration Over... DET0548 Detection Strategy for Exfiltration Over... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Scattered Lapsus Hunters

Type: Unknown Active
Scattered Lapsus$ Hunters Scattered Spider tracked as hold it for ransom UNC5936 +31 more
Infrastructure 13 IOC(s)
50%
Domain
weblogic.t3.srvr.ServerRuntime FalconFeeds.io DataBreaches.net GOLDVEIN.JAVA navvSetId.iHelp +3
IPv4 Address
200.107.207.26 104.194.11.200 161.97.99.49 8.8.8.8 162.55.17.215
Artifacts (6)
support@pubstorm.com support@pubstorm.net ops@rescana.com Info@rescana.com cmd.exe comsvcs.dll
Capability
52%
28 technique(s) 65 tool(s)/malware 3 CVE(s)
Alien BPFDoor Backdoor.Syskit Beacon BiBi BiBi wiper Chaos Cl0p Ransomware (for destructive sabotage) +57
T1041 Exfiltration Over Command & Control Channel T1055.001 Process Injection T1078 Valid Accounts T1090 Connection Proxy +11
collection
T1213
command and control
T1090
credential access
T1528 T1555
Victim
70%

Targeted Sectors

retail hospitality healthcare financial-services transportation aviation government telecommunications information-technology entertainment defense media gaming legal-services energy critical-infrastructure pharmaceutical non-profit education

Targeted Countries

IL IR FR SA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1592 T1595

Capability (Malware)

Alien BPFDoor Backdoor.Syskit
3 Delivery

Capability (Techniques)

T1199 T1566 T1566.002

Capability (Malware)

Alien BPFDoor Backdoor.Syskit
5 Installation

Capability (Techniques)

T1528 T1555

Capability (Malware)

Alien BPFDoor Backdoor.Syskit
6 Command & Control

Capability (Techniques)

T1213 T1090

Capability (Malware)

Alien BPFDoor Backdoor.Syskit
7 Actions on Objectives

Capability (Techniques)

T1041 T1567

Capability (Malware)

Alien BPFDoor Backdoor.Syskit
Leaving Threaticon

This link opens an external site that isn't part of the platform.