Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
gammax (threat actor)
Risk
65
High
11 techniques 49 tools/malware 0 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
1
T1059.003
Windows Command Shell execution
›
5 Installation
1
T1110
Brute Force credential access
›
6 Command & Control
1
T1005
Data from Local System collection
›
7 Actions on Objectives
6
T1041
Exfiltration Over C2 Channel exfiltration
T1486
Data Encrypted for Impact impact
T1027
Obfuscated Files or Information stealth
T1078
Valid Accounts stealth
T1202
Indirect Command Execution stealth
T1035
T1035
Stage risk: Critical High Medium None

Tools & Malware (49)

8Base Abyss Locker Akira Alphv Avaddon AvosLocker BRAIN Babuk Babuk Ransomware BlackCat BlackCat BlueSky ChaCha20 Chaos Conti Cuba Cyclops Dark DoppelPaymer Dove DoxxScan DragonForce Gammax Gammax Ransomware Global HELLOKITTY Hades Hive Infostealer Knight LockBit LockBit 3.0 Lynx Medusa Nemty Netwalker PICKLE PLAY Payload Payload Qilin RALord Royal Trigona Unknown VanHelsing YARA phishing rock

Indicators of Compromise (39)

Domain
Ransomwhere.org Logo.dev FalconFeeds.io eCrime.ch falconfeedsio.bsky.social win.sfile Kick.com win.hakbit +26 more
Email Address
support@galaxywarden.com resultyou@email.comIllustrative verifiedyourname@email.comvalue unverifiedyourname@email.comvalue you@email.comLEAKED

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (1)
M1038 Execution Prevention
Installation (4)
M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies
Command & Control (1)
M1057 Data Loss Prevention
Actions on Objectives (14)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +9 more

Detection Coverage

10 strategies
5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Installation (1)

DET0463 Brute Force Authentication Failures with...

Command & Control (1)

DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (5)

DET0200 Indirect Command Execution – Windows uti... DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over... DET0378 Behavioral Detection of Obfuscated Files... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
80%

gammax

Type: Criminal Sophistication: Medium First seen: 2026 Active
tracked as drones Bjorka SkyWave quic +22 more
Infrastructure 34 IOC(s)
50%
Domain
Ransomwhere.org Logo.dev FalconFeeds.io eCrime.ch falconfeedsio.bsky.social +29
Artifacts (5)
support@galaxywarden.com resultyou@email.comIllustrative verifiedyourname@email.comvalue unverifiedyourname@email.comvalue you@email.comLEAKED
Capability
50%
11 technique(s) 49 tool(s)/malware
8Base Abyss Locker Akira Alphv Avaddon AvosLocker BRAIN Babuk +41
T1035
collection
T1005
credential access
T1110
execution
T1059.003
Victim
70%

Targeted Sectors

financial-services healthcare construction manufacturing transportation government energy utilities oil-gas hospitality defense critical-infrastructure education telecommunications retail information-technology

Targeted Countries

SA US PK CA AU BR FR IL IR RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2026-07-03

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

8Base Abyss Locker Akira
4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

8Base Abyss Locker Akira
5 Installation

Capability (Techniques)

T1110

Capability (Malware)

8Base Abyss Locker Akira
6 Command & Control

Capability (Techniques)

T1005

Capability (Malware)

8Base Abyss Locker Akira
7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

8Base Abyss Locker Akira
Leaving Threaticon

This link opens an external site that isn't part of the platform.