Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UAT-9686 (threat actor)

Risk

High

10 techniques 47 tools/malware 32 vulnerabilities 11 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1203

Exploitation for Client Execution execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2020-12812

CVE CVE-2021-1675

CVE CVE-2021-22893

CVE CVE-2021-26855

CVE CVE-2021-26857

CVE CVE-2021-34527

CVE CVE-2021-41733

CVE CVE-2022-22965

CVE CVE-2022-30190

CVE CVE-2022-3602

CVE CVE-2022-3786

CVE CVE-2023-20198

CVE CVE-2023-20273

CVE CVE-2023-23397

CVE CVE-2023-34362

CVE CVE-2023-44487

CVE CVE-2025-0994

CVE CVE-2025-14174

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2025-20393

CVE CVE-2025-43529

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-55182

CVE CVE-2025-59718

CVE CVE-2025-59719

CVE CVE-2026-15409

CVE CVE-2026-15410

CVE CVE-2026-16232

CVE CVE-2026-20127

CVE CVE-2026-20182

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1059.003 - Command and Scripting Interpreter: Unix Shell

T1068 - Exploitation for Privilege Escalation

T1190 - Exploit Public-Facing Application

T1203 - Exploit for Client Execution

T1562.004

T1562.004 - Impair Defenses

Stage risk: Critical High Medium None

Tools & Malware (47)

AppDomainManager AquaPurge AquaShell AquaTunnel (ReverseSSH) BITS BRICKSTORM Backdoors CALENDAR Chisel ClickFix Clop Clop Ransomware Custom malware Custom web shell implants DNS hijacking Device code phishing Emotet EvilTokens Exploit code GitHub Global Group Policy Hafnium Havex RAT Hook Interception MSBuild Matrix MuddyWater Nexus OPENVAS PowerShell Predator Process Hollowing Python-based payloads STOP SamSam Silence SolarWinds Truebot Unknown VoidLink Web Shell Webshells netsh phishing systemd

Indicators of Compromise (11)

Domain

Silence.Downloader iphmx.com index.py

Email Address

services@cert.europa.eu

Filename

Next.js

SHA-256 Hash

145424de9f7d5dd73b599328ada03aa6d6cdcee8d5fe0f7cb832297183dbe4ca 85a0b22bd17f7f87566bd335349ef89e24a5a19f899825b4d178ce6240f58bfc 2db8ad6e0f43e93cc557fbda0271a436f9f2a478b1607073d4ee3d20a87ae7ef

IPv4 Address

172.233.67.176 172.237.29.147 38.54.56.95

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (13)

M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention +8 more

Detection Coverage

4 strategies

2/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (3)

DET0287 Exploitation for Client Execution – cros... DET0514 Detection Strategy for Exploitation for... DET0516 Behavioral Detection of Command and Scri...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UAT-9686

Type: Unknown Active

tracked as UAT 9686 AquaTunnel Chisel AquaPurge +6 more

Infrastructure 6 IOC(s)

50%

Domain

Silence.Downloader iphmx.com index.py

IPv4 Address

172.233.67.176 172.237.29.147 38.54.56.95

Artifacts (5)

services@cert.europa.eu Next.js 145424de9f7d5dd73b599328ada03aa6d6cdcee8d5fe0f7cb832297183dbe4ca 85a0b22bd17f7f87566bd335349ef89e24a5a19f899825b4d178ce6240f58bfc 2db8ad6e0f43e93cc557fbda0271a436f9f2a478b1607073d4ee3d20a87ae7ef

Capability

50%

10 technique(s) 47 tool(s)/malware 32 CVE(s)

AppDomainManager AquaPurge AquaShell AquaTunnel (ReverseSSH) BITS BRICKSTORM Backdoors CALENDAR +39

T1059.003 - Command and Scripting Interpreter: Unix Shell T1068 - Exploitation for Privilege Escalation T1190 - Exploit Public-Facing Application T1203 - Exploit for Client Execution +2

execution

T1059 T1203

initial access

T1190

privilege escalation

T1068

Victim

70%

Targeted Sectors

government critical-infrastructure financial-services defense telecommunications healthcare media non-profit energy education nuclear utilities manufacturing

Targeted Countries

CN RU UA US GB IL FR DE IR PL EG RO

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

AppDomainManager AquaPurge AquaShell

Infrastructure

Silence.Downloader iphmx.com index.py

4 Exploitation

Capability (Techniques)

T1059 T1203 T1068

Capability (Malware)

AppDomainManager AquaPurge AquaShell

Infrastructure

Silence.Downloader iphmx.com index.py