Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

JINX-0126 (threat actor)

Risk

High

7 techniques 43 tools/malware 6 vulnerabilities 13 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2024-20439

CVE CVE-2024-20440

CVE CVE-2025-22457

CVE CVE-2025-24085

CVE CVE-2025-24200

CVE CVE-2025-24201

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1027.001 Obfuscated Files or Information

T1059.004 Command Shell

T1078.001 Valid Accounts: Local Credentials

T1086 PowerShell (used for shell integration)

T1102.002 Web Application Layer Protocols

T1133 External Remote Services

T1204.004 User Execution: Malicious File

Stage risk: Critical High Medium None

Tools & Malware (43)

AdWind BLINDINGCAN BRUSHFIRE BlackEnergy BlackSuit BlackSuit ransomware Botnets Brute Ratel CALENDAR COPY … FROM PROGRAM exploit Cobalt Cobalt Strike Dark Gh0st Ghost RAT GitHub GitHub XMRig fetching script Global Havex RAT Hive INC Ransomware Nexus Ninja OilRig PG_MEM PLAY PlugX Poison Ivy RATel RansomHub Rhysida Royal SectopRAT TRAILBLAZE Trojan WhatsApp XMRIG XMRig-C3 cpu_hu gh0st RAT phishing postmaster (Golang mimicking PostgreSQL) rhysida Ransomware

Indicators of Compromise (13)

Domain

thehackernews.com Ransomware.Wins.INC demo-cloud.space JD.com directory-list-1.0.txt TEEX.ORG Ransomware.Win.Rhysida Ransomware.Wins.Rhysida +4 more

Filename

ukc-field-july-2024.pdf

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

JINX-0126

Type: Unknown Active

tracked as fractionators

Infrastructure 12 IOC(s)

50%

Domain

thehackernews.com Ransomware.Wins.INC demo-cloud.space JD.com directory-list-1.0.txt +7

Artifacts (1)

ukc-field-july-2024.pdf

Capability

50%

7 technique(s) 43 tool(s)/malware 6 CVE(s)

AdWind BLINDINGCAN BRUSHFIRE BlackEnergy BlackSuit BlackSuit ransomware Botnets Brute Ratel +35

T1027.001 Obfuscated Files or Information T1059.004 Command Shell T1078.001 Valid Accounts: Local Credentials T1086 PowerShell (used for shell integration) +3

Victim

70%

Targeted Sectors

financial-services mining healthcare energy manufacturing government gaming transportation

Targeted Countries

BR US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges