Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Nickel Alley (threat actor)

Risk

High

6 techniques 46 tools/malware 2 vulnerabilities 31 IOCs 3/7 stages covered Deepest: Command & Control

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1195

Supply Chain Compromise initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1204.004

Malicious Copy and Paste execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2015-1701

CVE CVE-2026-3502

›

5 Installation

No data

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (46)

Anchor Buhtrap ClickFix Cobalt Crimson DEADEYE Dark DarkHotel ELMER Gentlemen GitHub Global Hellsing Hidden Cobra Hunter IRONHALO Jackal Lynx Matrix Mirage Mythic Naikon Nexus Nitro Poseidon PowerShell Predator PyLangGhost RAT Samurai ScreenConnect Shamoon Shark Snake Spear-phishing TeamSpy TrueConf Tsunami Turla UAT-8302 Unknown VICEROY Void curl gcman magecart phishing

Indicators of Compromise (31)

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +12 more

Filename

Lively.Watchdog.exe ZoomUpdateInstaller.bat Session.ClientSetup.exe ScreenConnect.WindowsClient.exe git.exe Node.js ProtonVPN.exe nethost.dll +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (14)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +9 more

Exploitation (7)

M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1038 Execution Prevention M1048 Application Isolation and Sandboxing +2 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Detection Coverage

6 strategies

3/7 stages covered

Delivery (3)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (2)

DET0340 User Execution – Malicious Copy & Paste... DET0514 Detection Strategy for Exploitation for...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Nickel Alley

Type: Unknown Active

tracked as the Newscaster Team cpyy APT3 Gothic Panda +17 more

Infrastructure 20 IOC(s)

50%

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +15

Artifacts (11)

Lively.Watchdog.exe ZoomUpdateInstaller.bat Session.ClientSetup.exe ScreenConnect.WindowsClient.exe git.exe Node.js +5

Capability

50%

6 technique(s) 46 tool(s)/malware 2 CVE(s)

Anchor Buhtrap ClickFix Cobalt Crimson DEADEYE Dark DarkHotel +38

command and control

T1105

execution

T1204.004

initial access

T1189 T1195 T1566.001

privilege escalation

T1068

Victim

70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications aerospace media education information-technology maritime manufacturing think-tank healthcare pharmaceutical chemical mining hospitality legal-services nuclear entertainment

Targeted Countries

US CN GB IN JP DE KR IR RU SA TW FR CA IL TR AU KZ PK UA VN PL KP AE SG NL BR ES IQ MX BY IT SY RO EG AZ

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1195 T1566.001

Capability (Malware)

Anchor Buhtrap ClickFix

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles

4 Exploitation

Capability (Techniques)

T1204.004 T1068

Capability (Malware)

Anchor Buhtrap ClickFix

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

Anchor Buhtrap ClickFix

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles