Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
mirage kitten (threat actor)
Risk
84
Critical
14 techniques 52 tools/malware 33 vulnerabilities 36 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
36
T1053
Scheduled Task/Job execution
T1059
Command and Scripting Interpreter execution
T1204.001
Malicious Link execution
CVE CVE-2017-7921
CVE CVE-2021-21974
CVE CVE-2021-33044
CVE CVE-2021-3493
CVE CVE-2021-4034
CVE CVE-2022-21894
CVE CVE-2022-26134
CVE CVE-2022-30190
CVE CVE-2022-31199
CVE CVE-2022-47986
CVE CVE-2023-1389
CVE CVE-2023-22518
CVE CVE-2023-2868
CVE CVE-2023-34362
CVE CVE-2023-36025
CVE CVE-2023-46604
CVE CVE-2024-21412
CVE CVE-2024-3400
CVE CVE-2024-40766
CVE CVE-2024-7344
CVE CVE-2025-0994
CVE CVE-2025-21042
CVE CVE-2025-2783
CVE CVE-2025-3248
CVE CVE-2025-49704
CVE CVE-2025-49706
CVE CVE-2025-53770
CVE CVE-2025-53771
CVE CVE-2025-55182
CVE CVE-2025-66376
CVE CVE-2026-21509
CVE CVE-2026-42897
CVE CVE-2026-50522
›
5 Installation
2
T1057
Process Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
›
6 Command & Control
6
T1056.001
Keylogging collection
T1113
Screen Capture collection
T1115
Clipboard Data collection
T1071.004
DNS command and control
T1105
Ingress Tool Transfer command and control
T1219
Remote Access Tools command and control
›
7 Actions on Objectives
2
T1041
Exfiltration Over C2 Channel exfiltration
T1064
T1064
Stage risk: Critical High Medium None

Tools & Malware (52)

Akira ArcBridge Backdoors BlackCat BridgeHead CALENDAR Chaos ClickFix Cobalt Cobalt Strike Cuba Dark Daxin Ferocious GalaxyGato GenieLocker GitHub Global GoSerpent Handala HermeticWiper Infostealer Leverage LockBit MarkiRAT Mirage Mirage Kitten Nexus NightLedger Nimbus Manticore OilRig OlympicDestroyer PLAY Payload Payload Phantom Stealer Phishing campaigns Phishing emails PowerShell Psiphon Qilin RedLine Rootkit Smoke Sandstorm Subtle Snail Telegram Trojan Tuoni UNC1549 Unknown Void phishing

Indicators of Compromise (36)

Domain
Downloader.Climax jobs-fifa.com Mallory.ai BI.ZONE fifa.com fiffa.com e-library.wiki elibrary.ru +6 more
Email Address
hivemind@polyswarm.io support@e-library.wiki info@ai-impact.co.za advertise@ai-impact.co.za
Filename
a.dll srt64.sys Node.js Next.js kbdus.dll kbdus1.dll Everything.exe
SHA-256 Hash
5db0209455e36b2dc2f30f79c758e6cd178b5609ff24be841d6266f1e150a2b7 76ab6e2a89c9df04387913983f636999d2241470fc21b32d718e49a55c0014a3 728142cbf4903be54d71ddce18634265944bb1c8ac0e802da3b66bf9e326185b be417649c7ffd97e6d7f6ec2dabcd8e8eae0b64211f7db668016960ce263bb79 2548b115b20a3f48b4617e78e5433b068d3ab34cd9abf35d39ee5b7e330e417a 3fe080a7539d3f1d73d18271520266d1a8652c790a6a9ca5af22d87129344598 95a20614a82e3e2eb4f4885f77eba76e936d6466482d78980f315711c9d75fb7 e28085e8d64bb737721b1a1d494f177e571c47aab7c9507dba38253f6183af35
IPv4 Address
1.1.4.6 1.1.4.4 1.1.5.0

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (14)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more
Installation (2)
M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions
Command & Control (5)
M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic M1038 Execution Prevention M1042 Disable or Remove Feature or Program
Actions on Objectives (2)
M1031 Network Intrusion Prevention M1057 Data Loss Prevention

Detection Coverage

13 strategies
5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0066 User Execution – Malicious Link (click →... DET0094 Cross-Platform Behavioral Detection of S... DET0516 Behavioral Detection of Command and Scri...

Installation (2)

DET0034 Detection of Adversarial Process Discove... DET0112 Boot or Logon Initialization Scripts Det...

Command & Control (6)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0341 Clipboard Data Access with Anomalous Con... DET0346 Detect Screen Capture via Commands and A... DET0400 Behavioral Detection of DNS Tunneling an... +1 more

Actions on Objectives (1)

DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

mirage kitten

Type: Unknown Active
Smoke Sandstorm Subtle Snail UNC1549 tracked as CVE-2025-2783 +9 more
Infrastructure 17 IOC(s)
50%
Domain
Downloader.Climax jobs-fifa.com Mallory.ai BI.ZONE fifa.com +9
IPv4 Address
1.1.4.6 1.1.4.4 1.1.5.0
Artifacts (19)
hivemind@polyswarm.io support@e-library.wiki info@ai-impact.co.za advertise@ai-impact.co.za a.dll srt64.sys +13
Capability
50%
14 technique(s) 52 tool(s)/malware 33 CVE(s)
Akira ArcBridge Backdoors BlackCat BridgeHead CALENDAR Chaos ClickFix +44
T1064
collection
T1056.001 T1113 T1115
command and control
T1071.004 T1105 T1219
discovery
T1057
Victim
70%

Targeted Sectors

aerospace defense communications government financial-services telecommunications healthcare aviation education critical-infrastructure hospitality transportation media energy utilities information-technology retail non-profit manufacturing

Targeted Countries

Burkina Faso Egypt Ethiopia Jordan Pakistan Tanzania, United Republic of IR CN US RU UA PK EG IN SY TW BY BR KZ MX CA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Akira ArcBridge Backdoors
4 Exploitation

Capability (Techniques)

T1053 T1059 T1204.001

Capability (Malware)

Akira ArcBridge Backdoors
5 Installation

Capability (Techniques)

T1057 T1037

Capability (Malware)

Akira ArcBridge Backdoors
6 Command & Control

Capability (Malware)

Akira ArcBridge Backdoors
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Akira ArcBridge Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.