Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
GlobalSecretGroup (threat actor)
Risk
93
Critical
35 techniques 43 tools/malware 4 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1589.001
Credentials reconnaissance
›
2 Weaponization
No data
›
3 Delivery
4
T1190
Exploit Public-Facing Application initial access
T1195.001
Compromise Software Dependencies and Development Tools initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
7
T1053
Scheduled Task/Job execution
T1203
Exploitation for Client Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2025-59718
CVE CVE-2025-59719
CVE CVE-2026-17434
CVE CVE-2026-24858
›
5 Installation
9
T1110
Brute Force credential access
T1016
System Network Configuration Discovery discovery
T1046
Network Service Discovery discovery
T1057
Process Discovery discovery
T1083
File and Directory Discovery discovery
T1135
Network Share Discovery discovery
T1518.001
Security Software Discovery discovery
T1526
Cloud Service Discovery discovery
T1505.002
Transport Agent persistence
›
6 Command & Control
2
T1219
Remote Access Tools command and control
T1021
Remote Services lateral movement
›
7 Actions on Objectives
16
T1222.001
Windows Permissions defense impairment
T1553.003
SIP and Trust Provider Hijacking defense impairment
T1020
Automated Exfiltration exfiltration
T1041
Exfiltration Over C2 Channel exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1490
Inhibit System Recovery impact
T1531
Account Access Removal impact
T1027
Obfuscated Files or Information stealth
T1078
Valid Accounts stealth
T1127
Trusted Developer Utilities Proxy Execution stealth
T1236
T1236
T1294
T1294
T1562.006
T1562.006
T1572.001
T1572.001
T1640.004
T1640.004
Stage risk: Critical High Medium None

Tools & Malware (43)

8Base Akira Anubis BRAIN BianLian Black Basta BlackByte BlackCat BlackCat BlackSuit BlueSky Brain Cipher Cactus Clop Clop Crisis Dark Device code phishing DragonForce Evilginx Gentlemen Global Global Secret Group ransomware Hunters International INC Ransomware Icarus Infostealer Leverage LockBit LockBit 3.0 Lynx PLAY Phishing campaigns Phishing frameworks Phishing tools Pink Qilin RansomHub STOP SafePay SynAck Telegram phishing

Indicators of Compromise (39)

Domain
novumenergy.com FalconFeeds.io vernonwaldrep.com westnovasuperline.ca sinopenergia.com.br nourison.com coldfrontdist.com portmanfinancegroup.co.uk +24 more
Email Address
brain.support@cyberfear.com ciphbit@onionmail.org support@vectra.ai
URL
http://www.torproject.org/download http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion http://www.torproject.org/download/ http://torproject.org/|

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Delivery (17)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +12 more
Exploitation (10)
M1018 User Account Management M1019 Threat Intelligence Program M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +5 more
Installation (11)
M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation +6 more
Command & Control (10)
M1018 User Account Management M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1034 Limit Hardware Installation +5 more
Actions on Objectives (20)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +15 more

Detection Coverage

30 strategies
6/7 stages covered

Reconnaissance (1)

DET0813 Detection of Credentials

Delivery (4)

DET0009 Supply-chain tamper in dependencies/dev-... DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0094 Cross-Platform Behavioral Detection of S... DET0287 Exploitation for Client Execution – cros... DET0514 Detection Strategy for Exploitation for...

Installation (9)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0166 Detection Strategy for T1505.002 - Trans... DET0182 Behavior-chain detection for T1135 Netwo... DET0195 Behavioral Detection of System Network C... +4 more

Command & Control (2)

DET0269 Behavioral Detection Strategy for Remote... DET0496 Behavior-Chain Detection for Remote Acce...

Actions on Objectives (11)

DET0120 Account Access Removal via Multi-Platfor... DET0172 Behavior-chain, platform-aware detection... DET0215 Detection of Multi-Platform File Encrypt... DET0329 Behavioral Detection for T1490 - Inhibit... DET0348 Detection Strategy for Exfiltration Over... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

GlobalSecretGroup

Type: Unknown Active
tracked as APT43 Midnight Blizzard Nobelium NGOs +3 more
Infrastructure 36 IOC(s)
50%
Domain
novumenergy.com FalconFeeds.io vernonwaldrep.com westnovasuperline.ca sinopenergia.com.br +27
URL
http://www.torproject.org/download http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion http://www.torproject.org/download/ http://torproject.org/|
Artifacts (3)
brain.support@cyberfear.com ciphbit@onionmail.org support@vectra.ai
Capability
50%
35 technique(s) 43 tool(s)/malware 4 CVE(s)
8Base Akira Anubis BRAIN BianLian Black Basta BlackByte BlackCat +35
T1236 T1294 T1562.006 T1572.001 +1
command and control
T1219
credential access
T1110
defense impairment
T1222.001 T1553.003
Victim
70%

Targeted Sectors

healthcare manufacturing defense financial-services government transportation retail telecommunications non-profit oil-gas hospitality utilities construction legal-services mining chemical critical-infrastructure information-technology aviation

Targeted Countries

US RU BR CN GB AU MX ES CA UA IN IQ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.001

Capability (Malware)

8Base Akira Anubis
3 Delivery

Capability (Malware)

8Base Akira Anubis
4 Exploitation

Capability (Techniques)

T1053 T1203 T1068

Capability (Malware)

8Base Akira Anubis
5 Installation

Capability (Malware)

8Base Akira Anubis
6 Command & Control

Capability (Techniques)

T1219 T1021

Capability (Malware)

8Base Akira Anubis
7 Actions on Objectives

Capability (Malware)

8Base Akira Anubis
Leaving Threaticon

This link opens an external site that isn't part of the platform.