Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
emperador (threat actor)
Risk
86
Critical
22 techniques 40 tools/malware 1 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595.002
Vulnerability Scanning reconnaissance
›
2 Weaponization
1
T1608.001
Upload Malware resource development
›
3 Delivery
3
T1190
Exploit Public-Facing Application initial access
T1195.002
Compromise Software Supply Chain initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
4
T1059.001
PowerShell execution
T1059.005
Visual Basic execution
T1059.006
Python execution
CVE CVE-2026-33017
›
5 Installation
2
T1082
System Information Discovery discovery
T1133
External Remote Services persistence
›
6 Command & Control
1
T1071.001
Web Protocols command and control
›
7 Actions on Objectives
11
T1112
Modify Registry defense impairment
T1020
Automated Exfiltration exfiltration
T1041
Exfiltration Over C2 Channel exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1657
Financial Theft impact
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1070.004
File Deletion stealth
T1620
Reflective Code Loading stealth
Stage risk: Critical High Medium None

Tools & Malware (40)

Akira Axios Backdoors BlackCat BlackSuit Cobalt Conti Curl Dark GitHub GitHub Actions Global Hook Impacket Junction Leverage LockBit Lynx Malware Mythic Neuron Payload Payload Phishing campaigns PlugX PowerShell Proton Ransomware variants Rhysida Royal Royal Ransomware ShadowPad ShadowPad Malware Signal Trojan Unknown VBScript Winrar phishing phishing emails

Indicators of Compromise (40)

Domain
package.md sfrclak.com updata.dsqurey.com packages.npm.org Philstar.com Preprints.org FalconFeeds.io
Email Address
ifstap@proton.me
Filename
nView64.dll FmApp.exe FmApp.dll U3BoostSvr64.exe syncappw.exe syncapp.dll EN.pdf LOC.dll +15 more
SHA-256 Hash
c8268641aecad7bd32d20432da49bb8bfc9fe7391b92b5b06352e7f4c93bc19e 28d78e52420906794e4059a603fa9f22d5d6e4479d91e9046a97318c83998679 aa1233393dded792b74e334c50849c477c4b86838b32ef45d6ab0dc36b4511e3 f4e8841a14aa38352692340729c3ed6909d7521dd777518f12b8bd2d15ea00c5 41128b82fa12379034b3c42bdecf8e3b435089f19a5d57726a2a784c25e9d91f bdf019bc6cfb239f0beae4275246216cd8ae8116695657a324497ec96e538aac e06710652fa3c8b45fd0fece3b59e7614ad59a9bc0c570f4721aee3293ecd2d1 9df4624f815d9b04d31d9b156f7debfd450718336eb0b75100d02cb45d47bd9a
IPv4 Address
142.11.206.73

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (9)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Installation (5)
M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (15)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +10 more

Detection Coverage

22 strategies
7/7 stages covered

Reconnaissance (1)

DET0867 Detection of Vulnerability Scanning

Weaponization (1)

DET0824 Detection of Upload Malware

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att... DET0309 Compromised software/update chain (insta...

Exploitation (3)

DET0063 Cross-Platform Behavioral Detection of P... DET0076 Behavioral Detection of Visual Basic Exe... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (2)

DET0354 Behavior-chain detection for T1133 Exter... DET0525 System Discovery via Native and Remote U...

Command & Control (1)

DET0027 Detection of Web Protocol-Based C2 Over...

Actions on Objectives (11)

DET0127 Behavioral Detection of Masquerading Acr... DET0131 Behavioral Detection Strategy for Exfilt... DET0140 Behavioral Detection of Malicious File D... DET0215 Detection of Multi-Platform File Encrypt... DET0280 Behavior-Based Registry Modification Det... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
80%

emperador

Type: Criminal Sophistication: Medium First seen: 2026 Active
DeputyDog Emperador Oscuro Marble Emperador Dark Royal Ransomware BlackCat +6 more
Infrastructure 8 IOC(s)
50%
Domain
package.md sfrclak.com updata.dsqurey.com packages.npm.org Philstar.com +2
IPv4 Address
142.11.206.73
Artifacts (32)
ifstap@proton.me nView64.dll FmApp.exe FmApp.dll U3BoostSvr64.exe syncappw.exe +26
Capability
50%
22 technique(s) 40 tool(s)/malware 1 CVE(s)
Akira Axios Backdoors BlackCat BlackSuit Cobalt Conti Curl +32
command and control
T1071.001
defense impairment
T1112
discovery
T1082
execution
T1059.001 T1059.005 T1059.006
Victim
70%

Targeted Sectors

financial-services government telecommunications healthcare defense education critical-infrastructure manufacturing retail media entertainment non-profit information-technology hospitality utilities aerospace maritime nuclear gaming food-agriculture construction transportation pharmaceutical

Targeted Countries

UA IN CN RU GB US DE KP IR PK BY PL TW CA AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2026-08-10

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.002

Capability (Malware)

Akira Axios Backdoors
2 Weaponization

Capability (Techniques)

T1608.001

Capability (Malware)

Akira Axios Backdoors
3 Delivery

Capability (Techniques)

T1190 T1195.002 T1566.001

Capability (Malware)

Akira Axios Backdoors
4 Exploitation

Capability (Techniques)

T1059.001 T1059.005 T1059.006

Capability (Malware)

Akira Axios Backdoors
5 Installation

Capability (Techniques)

T1082 T1133

Capability (Malware)

Akira Axios Backdoors
6 Command & Control

Capability (Techniques)

T1071.001

Capability (Malware)

Akira Axios Backdoors
7 Actions on Objectives

Capability (Malware)

Akira Axios Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.