Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Codefinger (threat actor)

Risk

High

3 techniques 49 tools/malware 12 vulnerabilities 54 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2021-26855

CVE CVE-2021-26857

CVE CVE-2021-26858

CVE CVE-2021-27065

CVE CVE-2021-43798

CVE CVE-2023-2868

CVE CVE-2023-3519

CVE CVE-2023-7102

CVE CVE-2024-3400

CVE CVE-2025-0282

CVE CVE-2025-20393

CVE CVE-2025-61882

›

5 Installation

No data

›

6 Command & Control

T1021

Remote Services lateral movement

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1486

Data Encrypted for Impact impact

Stage risk: Critical High Medium None

Tools & Malware (49)

ACR Stealer AWS CLI Akira Backdoors BlackCat C2 infrastructure CALENDAR Cl0p Ransomware Cobalt Strike Dark DarkRadiation DripDropper Malware Expand FatalRat GitHub Global Infostealer LAMEHUG Leverage LockBit Lucifer Botnet Nefilim Nexus Node.js P2PInfect PLAY Payload Payload Phishing emails RUBYCARP RansomHub Ransomware variants RedTail Cryptomining Remote access tools Rootkit SNAPPYBEE STOP SUNBURST ShadowSyndicate Shai-Hulud TOUGHPROGRESS Telegram Unknown Visual Studio Code curl ngrok npm packages phishing whoami

Indicators of Compromise (54)

Domain

Node.js attack.mitre.org 6.jpg 7.jpg word.msapp.workers.dev resource.infinityfreeapp.com NTDS.DIT package.json +27 more

Email Address

support@vectra.ai boroda70@meta.ua

Filename

Fangao.dll mycustomkeymaterial.bin Before.dll Appendix.pdf.zip verify.js Dodatok.pdf.zip svchost.exe Node.js +5 more

IPv4 Address

144.126.202.227

URL

http://my5353.com/nWyTf http://83hfhjasksn.hopto.org:443/kljkalsd/ajkl12389/slkj1n_189n http://laughing-space-capybara-x5g6rjxq7jwvfp6q6-443.app.github.dev/sllkjdsss_user-dasd.txt

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

10 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (6)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program +1 more

Actions on Objectives (4)

M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup M1057 Data Loss Prevention

Detection Coverage

3 strategies

2/7 stages covered

Command & Control (1)

DET0269 Behavioral Detection Strategy for Remote...

Actions on Objectives (2)

DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Codefinger

Type: Unknown Active

tracked as Deed RAT a variant of ShadowPad entities in the defense security sectors +7 more

Infrastructure 39 IOC(s)

50%

Domain

Node.js attack.mitre.org 6.jpg 7.jpg word.msapp.workers.dev +30

IPv4 Address

144.126.202.227

URL

http://my5353.com/nWyTf http://83hfhjasksn.hopto.org:443/kljkalsd/ajkl12389/slkj1n_189n http://laughing-space-capybara-x5g6rjxq7jwvfp6q6-443.app.github.dev/sllkjdsss_user-dasd.txt

Artifacts (15)

support@vectra.ai boroda70@meta.ua Fangao.dll mycustomkeymaterial.bin Before.dll Appendix.pdf.zip +9

Capability

50%

3 technique(s) 49 tool(s)/malware 12 CVE(s)

ACR Stealer AWS CLI Akira Backdoors BlackCat C2 infrastructure CALENDAR Cl0p Ransomware +41

exfiltration

T1041

impact

T1486

lateral movement

T1021

Victim

70%

Targeted Sectors

financial-services defense government healthcare education telecommunications manufacturing mining transportation critical-infrastructure energy hospitality information-technology media utilities non-profit

Targeted Countries

US CN TW AE DE GB KP JP AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

6 Command & Control

Capability (Techniques)

T1021

Capability (Malware)

ACR Stealer AWS CLI Akira

Infrastructure

Node.js attack.mitre.org 6.jpg

7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

ACR Stealer AWS CLI Akira

Infrastructure

Node.js attack.mitre.org 6.jpg