Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
APT-C-12 (threat actor)
Risk
87
Critical
44 techniques 77 tools/malware 2 vulnerabilities 37 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
8
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1583.004
Server resource development
T1584
Compromise Infrastructure resource development
T1584.001
Domains resource development
T1584.003
Virtual Private Server resource development
T1584.004
Server resource development
›
3 Delivery
8
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1195
Supply Chain Compromise initial access
T1195.002
Compromise Software Supply Chain initial access
T1199
Trusted Relationship initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
5
T1059.003
Windows Command Shell execution
T1203
Exploitation for Client Execution execution
T1546
Event Triggered Execution privilege escalation
CVE CVE-2021-26855
CVE CVE-2023-21554
›
5 Installation
4
T1003
OS Credential Dumping credential access
T1040
Network Sniffing credential access
T1087
Account Discovery discovery
T1505.003
Web Shell persistence
›
6 Command & Control
10
T1074
Data Staged collection
T1071.001
Web Protocols command and control
T1090
Proxy command and control
T1090.003
Multi-hop Proxy command and control
T1105
Ingress Tool Transfer command and control
T1219
Remote Access Tools command and control
T1573
Encrypted Channel command and control
T1021
Remote Services lateral movement
T1210
Exploitation of Remote Services lateral movement
T1550.001
Application Access Token lateral movement
›
7 Actions on Objectives
11
T1567
Exfiltration Over Web Service exfiltration
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1561
Disk Wipe impact
T1014
Rootkit stealth
T1078
Valid Accounts stealth
T1078.004
Cloud Accounts stealth
T1218
System Binary Proxy Execution stealth
T1574
Hijack Execution Flow stealth
T1562
T1562
T1656
T1656
Stage risk: Critical High Medium None

Tools & Malware (77)

APT38 ATI-Agent AdobeARM Agent.btz Agent.dne Akira BARIUM BlackByte Carbanak Carbon China Chopper / Ckife Webshells Cobalt Cobalt Strike Confucius Conti Crimson Custom RAT backdoors Dark DarkHotel Emissary GCat Gazer GhostEmperor Global GreyEngergy Mini as their 1st-stage implant Hafnium Jackal Kimsuky Labyrinth Chollima LazyCat Lynx Machete Mango Metasploit Framework Mimikatz MiniDionis Mirage MuddyWater Mythic Naikon Nautilus Net Neuron Nexus OceanLotus OilRig OlympicDestroyer Pink Poseidon PowerShell scripts RedCurl Sednit SideWinder Snake Sofacy Spear-phishing Spear-phishing emails StrongPity Systeminfo Tasklist Tavdig TeamTNT Tsunami Turla Uroburos Void Web shell suites (e.g., Ckife, China Chopper) WhiteBear Wicked Winnti Wipbot gpresult phishing pwdump reGeorge route wce

Indicators of Compromise (37)

Domain
Temp.Hex TEMP.Avengers TEMP.Hippo TMP.Lapis TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex +23 more
Email Address
rocke@live.cn
Filename
1356-c1c0cbeca59ade9b.js 8985-aac998da933c9fa0.js 5889-e987f21560aaf28e.js 2729-aeb73907a19f63b5.js c16f53c3-409df1246fc2628c.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

39 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (19)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +14 more
Exploitation (5)
M1026 Privileged Account Management M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software
Installation (13)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management +8 more
Command & Control (22)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1018 User Account Management M1019 Threat Intelligence Program M1020 SSL/TLS Inspection +17 more
Actions on Objectives (22)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +17 more

Detection Coverage

42 strategies
6/7 stages covered

Weaponization (8)

DET0838 Detection of Virtual Private Server DET0854 Detection of Virtual Private Server DET0863 Detection of Domains DET0871 Detection of Server DET0874 Detection of Server +3 more

Delivery (8)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... +3 more

Exploitation (3)

DET0010 Behavioral Detection of Event Triggered... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros...

Installation (4)

DET0234 Credential Dumping via Sensitive Memory... DET0314 Detection Strategy for Network Sniffing... DET0394 Web Shell Detection via Server Behavior... DET0587 Enumeration of User or Account Informati...

Command & Control (10)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0118 Exploitation of Remote Services – multi-... DET0185 Behavioral Detection Strategy for Use Al... +5 more

Actions on Objectives (9)

DET0081 Detection of Proxy Execution via Trusted... DET0137 Detection Strategy for Disk Wipe via Dir... DET0146 Detection of Data Destruction Across Pla... DET0215 Detection of Multi-Platform File Encrypt... DET0218 Detection Strategy for Hijack Execution... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

APT-C-12

Type: Nation-State Active
Sapphire Mushroom Blue Mushroom NuclearCrisis APT groups hackers +101 more
Infrastructure 31 IOC(s)
50%
Domain
Temp.Hex TEMP.Avengers TEMP.Hippo TMP.Lapis TEMP.Zagros +26
Artifacts (6)
rocke@live.cn 1356-c1c0cbeca59ade9b.js 8985-aac998da933c9fa0.js 5889-e987f21560aaf28e.js 2729-aeb73907a19f63b5.js c16f53c3-409df1246fc2628c.js
Capability
56%
44 technique(s) 77 tool(s)/malware 2 CVE(s)
APT38 ATI-Agent AdobeARM Agent.btz Agent.dne Akira BARIUM BlackByte +69
T1562 T1656
collection
T1074
command and control
T1071.001 T1090 T1090.003 T1105 +2
credential access
T1003 T1040
Victim
70%

Targeted Sectors

government defense research financial-services telecommunications healthcare education non-profit energy manufacturing media aerospace critical-infrastructure information-technology pharmaceutical think-tank nuclear aviation hospitality legal-services transportation mining chemical gaming retail maritime entertainment oil-gas construction utilities

Targeted Countries

CN US RU IR IL SA VN UA AE JP PK GB IN AU KR TW TR SG DE KP BY RO MX ES PL CA LB FR NG IT AZ KZ europe

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

APT38 ATI-Agent AdobeARM
3 Delivery

Capability (Malware)

APT38 ATI-Agent AdobeARM
4 Exploitation

Capability (Techniques)

T1059.003 T1203 T1546

Capability (Malware)

APT38 ATI-Agent AdobeARM
5 Installation

Capability (Malware)

APT38 ATI-Agent AdobeARM
6 Command & Control

Capability (Malware)

APT38 ATI-Agent AdobeARM
7 Actions on Objectives

Capability (Techniques)

T1567 T1485 T1486 T1561

Capability (Malware)

APT38 ATI-Agent AdobeARM
Leaving Threaticon

This link opens an external site that isn't part of the platform.