Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Hunt3r Kill3rs (threat actor)

Risk

High

7 techniques 40 tools/malware 40 vulnerabilities 38 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2021-22861

CVE CVE-2022-1159

CVE CVE-2023-33538

CVE CVE-2023-3595

CVE CVE-2023-46290

CVE CVE-2023-6875

CVE CVE-2024-21914

CVE CVE-2024-21915

CVE CVE-2024-21917

CVE CVE-2024-23897

CVE CVE-2025-26385

CVE CVE-2025-46818

CVE CVE-2025-66430

CVE CVE-2026-0257

CVE CVE-2026-0625

CVE CVE-2026-12569

CVE CVE-2026-12957

CVE CVE-2026-15682

CVE CVE-2026-16812

CVE CVE-2026-22769

CVE CVE-2026-25526

CVE CVE-2026-31431

CVE CVE-2026-35033

CVE CVE-2026-40369

CVE CVE-2026-41089

CVE CVE-2026-42271

CVE CVE-2026-46817

CVE CVE-2026-48172

CVE CVE-2026-48331

CVE CVE-2026-48939

CVE CVE-2026-49176

CVE CVE-2026-50522

CVE CVE-2026-52830

CVE CVE-2026-5386

CVE CVE-2026-56291

CVE CVE-2026-58644

CVE CVE-2026-64638

CVE CVE-2026-8631

CVE CVE-2026-8632

CVE CVE-2026-9082

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T0801

T0802

T0832

T0834

T0857

T0866

T0886

Stage risk: Critical High Medium None

Tools & Malware (40)

Backdoors CALENDAR Chaos ClickFix Cursor DCRAT Docker Gemini CLI GitHub Global HexaLocker Indrik Spider Infostealer Infostealer malware Kubernetes Leverage Malware Microsoft Teams MuddyWater Node.js Payload Payload Phishing campaigns Play PowerShell Remcos Remcos RAT ScreenConnect SentinelOne SolarWinds Spear-phishing Stealc Telegram Trojan VOLTZITE Void Webshell WhatsApp npm packages phishing

Indicators of Compromise (38)

Domain

moscollector.ru crypter.go demo-cloud.space ASP.NET ransom.cpp time.dat Cryptographic.cpp aes.cpp +4 more

Filename

Next.js Node.js

SHA-1 Hash

813c510fb2463ecc6dff7795ef96744ca82544b3 b958fb7241cc9675b8dd967b02df6a6ad92de52d c70d2350cbac3d0abeb896adcce2fcf243943633 eae366ee4a7c19a87bc5ab9360f4333907a6a387 f5d0c94b2be91342dc01ecf2f89e7e6f21a74b90 5499da31260a4aa75eea46c1d4aa6559074749a8 197d5c9c5cbf53ed3e78d53a008b6ad665fa3e4c 1f325950a7a8e1a2050e954f33d2c3774510bd6e +16 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Hunt3r Kill3rs

Type: Unknown Active

digital terrorism Forest Blizzard Dragos-designated threat group BAUXITE conducted reconnaissance research against OT +7 more

Infrastructure 12 IOC(s)

50%

Domain

moscollector.ru crypter.go demo-cloud.space ASP.NET ransom.cpp +7

Artifacts (26)

Next.js Node.js 813c510fb2463ecc6dff7795ef96744ca82544b3 b958fb7241cc9675b8dd967b02df6a6ad92de52d c70d2350cbac3d0abeb896adcce2fcf243943633 eae366ee4a7c19a87bc5ab9360f4333907a6a387 +20

Capability

50%

7 technique(s) 40 tool(s)/malware 40 CVE(s)

Backdoors CALENDAR Chaos ClickFix Cursor DCRAT Docker Gemini CLI +32

T0801 T0802 T0832 T0834 +3

Victim

70%

Targeted Sectors

financial-services government manufacturing critical-infrastructure energy healthcare oil-gas telecommunications defense education hospitality nuclear pharmaceutical media utilities aerospace mining retail gaming non-profit aviation legal-services maritime

Targeted Countries

CN IR RU UA IN JP GB US SG CA PL ES IT KR RO IL TR KP MX FR TW BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges