Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

JuiceLedger (threat actor)

Risk

Medium

0 techniques 40 tools/malware 8 vulnerabilities 39 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2023-36661

CVE CVE-2023-44487

CVE CVE-2023-50164

CVE CVE-2024-21887

CVE CVE-2024-3094

CVE CVE-2024-53677

CVE CVE-2026-29000

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Backdoors Buhtrap Cobalt DEADEYE Dark DarkHotel GitHub Global Guacamaya Hellsing Infostealer Jackal JuiceStealer Legitimate Software Lynx Malware Matrix Naikon Nexus Nitro Payload Payload Poseidon Predator Samurai SentinelOne Shai-Hulud Shamoon Spear-phishing TeamSpy Telegram Trojan Tsunami Turla Unknown VICEROY Void gcman npm packages phishing

Indicators of Compromise (39)

Domain

Console.WriteLine Process.GetProcessesByName process.Kill Thread.Sleep site.Source Cyber.Anarchy.Squad Directory.GetDirectories TEMP.Avengers +23 more

Email Address

security@pypi.org

Filename

Next.js config.exe

SHA-1 Hash

1a7464489568003173cd048a3bad41ca32dbf94f d249f19db3fe6ea4439f095bfe7aafd5a0a5d4d2 5eb92c45e0700d80dc24d3ad07a7e2d5b030c933 e5286353dec9a7fc0c6db378b407e0293b711e9b 13CFDF20DFA846C94358DBAC6A3802DC0671EAB2

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

JuiceLedger

Type: Unknown Active

APT28 Pawn Storm Fancy Bear Sednit Bladabindi +12 more

Infrastructure 31 IOC(s)

50%

Domain

Console.WriteLine Process.GetProcessesByName process.Kill Thread.Sleep site.Source +26

Artifacts (8)

security@pypi.org Next.js config.exe 1a7464489568003173cd048a3bad41ca32dbf94f d249f19db3fe6ea4439f095bfe7aafd5a0a5d4d2 5eb92c45e0700d80dc24d3ad07a7e2d5b030c933 +2

Capability

50%

40 tool(s)/malware 8 CVE(s)

Backdoors Buhtrap Cobalt DEADEYE Dark DarkHotel GitHub Global +32

Victim

70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications media aerospace education information-technology maritime manufacturing think-tank healthcare pharmaceutical chemical mining utilities gaming hospitality legal-services nuclear entertainment

Targeted Countries

US CN GB IN JP DE KR IR RU SA CA TW IL FR UA TR AU KZ PK VN PL AE SG NL BR ES IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges