Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

SEXi (threat actor)

Risk

High

2 techniques 40 tools/malware 19 vulnerabilities 40 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2014-6352

CVE CVE-2022-42475

CVE CVE-2023-4966

CVE CVE-2024-1708

CVE CVE-2024-1709

CVE CVE-2024-3400

CVE CVE-2024-55956

CVE CVE-2025-22224

CVE CVE-2025-22225

CVE CVE-2025-22226

CVE CVE-2025-23006

CVE CVE-2025-30406

CVE CVE-2025-32433

CVE CVE-2025-47812

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-55182

CVE CVE-2025-61882

CVE CVE-2025-66478

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T5000

T9000

Stage risk: Critical High Medium None

Tools & Malware (40)

Akira Backdoor malware Backdoors Beacon Black Basta BlackByte Cobalt Cobalt Strike Conti Custom Backdoor GitHub Global Kimsuky Leverage LockBit Malware Medusa Mobile malware MuddyWater OilRig Payload Payload Play PowerShell PowerShell backdoor React2Shell Rootkit RotaJakiro SEXi STOP Sliver SolarWinds TrickBot Trojan Turla Web Shell cmd.exe curl phishing systemd

Indicators of Compromise (40)

Domain

Trojan.Mebromi sex.sh Myworkdayjobs.com d5.sh macOS.OSAMiner keep.camdvr.org FalconFeeds.io pool.hashvault.pro +11 more

Filename

cmd.exe net.exe cipher.exe PACLOUD.exe Next.js Node.js

IPv4 Address

39.97.229.220 103.135.101.15 38.165.44.205 45.32.158.54 31.56.27.97 173.44.141.152 216.158.232.43 45.76.155.14

URL

http://:12000/sex.sh http:///vim http://vps-zap812595-1.zap-srv.com:3000/sex.sh http://help.093214.xyz:9731/fn32.sh http://keep.camdvr.org:8000/d5.sh http:///scripts/4thepool_miner.sh http:///5e51aff54626ef7f/x86_64

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

SEXi

Type: Unknown Active

SOCOTRA FORMOSA CVE-2025-55182 Project Spy Cridex +22 more

Infrastructure 34 IOC(s)

50%

Domain

Trojan.Mebromi sex.sh Myworkdayjobs.com d5.sh macOS.OSAMiner +14

IPv4 Address

39.97.229.220 103.135.101.15 38.165.44.205 45.32.158.54 31.56.27.97 +3

URL

http://:12000/sex.sh http:///vim http://vps-zap812595-1.zap-srv.com:3000/sex.sh http://help.093214.xyz:9731/fn32.sh http://keep.camdvr.org:8000/d5.sh +2

Artifacts (6)

cmd.exe net.exe cipher.exe PACLOUD.exe Next.js Node.js

Capability

50%

2 technique(s) 40 tool(s)/malware 19 CVE(s)

Akira Backdoor malware Backdoors Beacon Black Basta BlackByte Cobalt Cobalt Strike +32

T5000 T9000

Victim

70%

Targeted Sectors

financial-services government defense telecommunications manufacturing healthcare education transportation energy critical-infrastructure media retail information-technology aerospace hospitality non-profit mining pharmaceutical aviation construction maritime chemical legal-services nuclear gaming entertainment food-agriculture

Targeted Countries

US RU CN UA BR KR GB PL IN AU MX ES CA JP IT DE TR IL SY TW SA IR FR VN SG KP AE NL AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges