Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
APT-C-13 (threat actor)
Risk
100
Critical
43 techniques 47 tools/malware 15 vulnerabilities 38 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
2
T1583
Acquire Infrastructure resource development
T1586
Compromise Accounts resource development
›
3 Delivery
3
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
18
T1059
Command and Scripting Interpreter execution
T1203
Exploitation for Client Execution execution
T1546
Event Triggered Execution privilege escalation
CVE CVE-2012-0158
CVE CVE-2015-1641
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2019-19781
CVE CVE-2019-19871
CVE CVE-2019-3396
CVE CVE-2020-10189
CVE CVE-2021-26855
CVE CVE-2021-44207
CVE CVE-2021-44228
CVE CVE-2024-43451
CVE CVE-2026-15409
CVE CVE-2026-15410
CVE CVE-2026-8451
›
5 Installation
10
T1110
Brute Force credential access
T1555
Credentials from Password Stores credential access
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1098
Account Manipulation persistence
T1133
External Remote Services persistence
T1136
Create Account persistence
T1543
Create or Modify System Process persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
12
T1005
Data from Local System collection
T1074
Data Staged collection
T1119
Automated Collection collection
T1213
Data from Information Repositories collection
T1560
Archive Collected Data collection
T1001
Data Obfuscation command and control
T1008
Fallback Channels command and control
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
T1568
Dynamic Resolution command and control
T1573
Encrypted Channel command and control
›
7 Actions on Objectives
12
T1484
Domain or Tenant Policy Modification defense impairment
T1685
Disable or Modify Tools defense impairment
T1030
Data Transfer Size Limits exfiltration
T1041
Exfiltration Over C2 Channel exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1486
Data Encrypted for Impact impact
T1055.012
Process Hollowing stealth
T1134
Access Token Manipulation stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1197
BITS Jobs stealth
T1480
Execution Guardrails stealth
Stage risk: Critical High Medium None

Tools & Malware (47)

Akira BARIUM BITS Backdoors Barb(ie) Downloader BarbWire BlackByte Carbanak Cobalt Cobalt Strike DONOT DUSTPAN DUSTTRAP GitHub Global Google Drive Group Policy HeartCrypt KRNRAT Kimsuky Machete Malicious files MoleRAT Moriya MuddyWater Naikon Nexus Payload Payload PowerShell Process Hollowing Remcos Remcos RAT Rootkit Rundll32 SIMPOBOXSPY Scheduled Tasks Spark TESDAT Trojan Turla Web Shell Wicked Windows Command Shell Winnti njRAT phishing

Indicators of Compromise (38)

Domain
ADORE.XSECbackdoor TEMP.Veles republicadominica2025.ip-ddns.com elyeso.ip-ddns.com Formulario.html fausto-barb.website frances-thomas.com Tools.Ande +4 more
Filename
makecab.exe Final1278685280.exe powershell.exe runawy.exe Gaza.pdf dilx.exe svchost.exe MSBuild.exe +11 more
MD5 Hash
48b6064beec687fc110145cf7a19640d b167a0bc7b097550a89a5ba4cb258592
SHA-256 Hash
5b476e05aacea9edc14f7e4bab1b724ef54915f30c39ac87503ed395feae611e 6e896099a3ceb563f43f49a255672cfd14d88799f29617aa362ecd2128446a47 7bb719f1c64d627ecb1f13c97dc050a7bb1441497f26578f7b2a9302adbbb128
IPv4 Address
62.60.226.64 177.255.85.101

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (12)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +7 more
Installation (18)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +13 more
Command & Control (13)
M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1029 Remote Data Storage +8 more
Actions on Objectives (17)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +12 more

Detection Coverage

43 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (2)

DET0876 Detection of Compromise Accounts DET0895 Detection of Acquire Infrastructure

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0010 Behavioral Detection of Event Triggered... DET0287 Exploitation for Client Execution – cros... DET0516 Behavioral Detection of Command and Scri...

Installation (10)

DET0096 Account Manipulation Behavior Chain Dete... DET0112 Boot or Logon Initialization Scripts Det... DET0274 Boot or Logon Autostart Execution Detect... DET0354 Behavior-chain detection for T1133 Exter... DET0370 Recursive Enumeration of Files and Direc... +5 more

Command & Control (12)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0039 Detection Strategy for Dynamic Resolutio... DET0053 Detect Obfuscated C2 via Network Traffic... DET0060 Detect Ingress Tool Transfers via Behavi... +7 more

Actions on Objectives (12)

DET0098 Detect abuse of Windows BITS Jobs for do... DET0131 Behavioral Detection Strategy for Exfilt... DET0213 Detection Strategy for Data Transfer Siz... DET0215 Detection of Multi-Platform File Encrypt... DET0270 Detection of Domain or Tenant Policy Mod... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
50%

APT-C-13

Type: apt Active
APT-C-36 Blind Eagle cybercrime first appeared around 2018 an Arabic-speaking +17 more
Infrastructure 14 IOC(s)
50%
Domain
ADORE.XSECbackdoor TEMP.Veles republicadominica2025.ip-ddns.com elyeso.ip-ddns.com Formulario.html +7
IPv4 Address
62.60.226.64 177.255.85.101
Artifacts (24)
makecab.exe Final1278685280.exe powershell.exe runawy.exe Gaza.pdf dilx.exe +18
Capability
50%
43 technique(s) 47 tool(s)/malware 15 CVE(s)
Akira BARIUM BITS Backdoors Barb(ie) Downloader BarbWire BlackByte Carbanak +39
collection
T1005 T1074 T1119 T1213 +1
command and control
T1001 T1008 T1071 T1071.001 +3
credential access
T1110 T1555
defense impairment
T1484 T1685
Victim
70%

Targeted Sectors

government energy defense telecommunications financial-services healthcare education manufacturing media non-profit critical-infrastructure pharmaceutical aviation hospitality retail aerospace mining gaming information-technology think-tank transportation chemical oil-gas legal-services nuclear utilities entertainment maritime construction

Targeted Countries

CN US RU VN IR GB JP IL UA IN AU SA PK TW AE SG KR DE BY TR MX ES PL CA RO FR NG KP IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Apt

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

Akira BARIUM BITS
2 Weaponization

Capability (Techniques)

T1583 T1586

Capability (Malware)

Akira BARIUM BITS
3 Delivery

Capability (Techniques)

T1190 T1566 T1566.001

Capability (Malware)

Akira BARIUM BITS
4 Exploitation

Capability (Techniques)

T1059 T1203 T1546

Capability (Malware)

Akira BARIUM BITS
5 Installation

Capability (Malware)

Akira BARIUM BITS
6 Command & Control

Capability (Malware)

Akira BARIUM BITS
7 Actions on Objectives

Capability (Malware)

Akira BARIUM BITS
Leaving Threaticon

This link opens an external site that isn't part of the platform.