Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

nexus team (threat actor)

Risk

Critical

15 techniques 45 tools/malware 36 vulnerabilities 38 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1595.001

Scanning IP Blocks reconnaissance

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1053.003

Cron execution

T1059.003

Windows Command Shell execution

T1059.004

Unix Shell execution

CVE CVE-2009-0238

CVE CVE-2012-1854

CVE CVE-2017-17215

CVE CVE-2020-9715

CVE CVE-2023-1389

CVE CVE-2023-21529

CVE CVE-2023-27351

CVE CVE-2023-36424

CVE CVE-2024-1708

CVE CVE-2024-27199

CVE CVE-2024-3721

CVE CVE-2024-57726

CVE CVE-2024-57728

CVE CVE-2024-7399

CVE CVE-2025-14847

CVE CVE-2025-2749

CVE CVE-2025-29635

CVE CVE-2025-32975

CVE CVE-2025-48700

CVE CVE-2025-60710

CVE CVE-2026-1340

CVE CVE-2026-20122

CVE CVE-2026-20128

CVE CVE-2026-20133

CVE CVE-2026-21643

CVE CVE-2026-32201

CVE CVE-2026-32202

CVE CVE-2026-33032

CVE CVE-2026-33825

CVE CVE-2026-34197

CVE CVE-2026-34621

CVE CVE-2026-3502

CVE CVE-2026-35616

CVE CVE-2026-39987

CVE CVE-2026-41940

CVE CVE-2026-5281

›

5 Installation

T1110.001

Password Guessing credential access

T1110.004

Credential Stuffing credential access

T1087.002

Domain Account discovery

T1133

External Remote Services persistence

T1543.002

Systemd Service persistence

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1485

Data Destruction impact

T1496

Resource Hijacking impact

T1498.001

Direct Network Flood impact

T1078.004

Cloud Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (45)

3CX Backdoor 404 Keylogger Botnets Bulletproof hosting CALENDAR Chaos Cobalt Cobalt Strike ConnectWise Dark ETERNALBLUE Exploit code GitHub Global Havoc Interception Medusa Medusa Ransomware Mirai Mirai botnet MySQL Nexcorium Nexus Nmap Open source tools PHOTO PLAY Payload Payload Persistence mechanisms PowerShell Resident STOP ScreenConnect SimpleHelp Sshdinjector StrongPity Unknown Windows Command Shell XMRIG YARA jason nuclei phishing systemd

Indicators of Compromise (38)

Domain

www.nexuspolicyinstitute.org Mirai.AEH ELF.Mirai.ATL Mirai.EGX TBK.DVR.SOSTREAMAX.Command.Injection persist.service dlink.sh www.themouseexchange.org +13 more

Email Address

S.Bailey@bath.ac.uk

Filename

ftp.exe powershell.exe cmd.exe 1dt2-jz5ox0c7.js sqlservr.exe 21bnup79gh4v5.js 2zo22dmokkih7.js

SHA-256 Hash

696aeb6321313919f0a41a520e6fa715450bbfb271a9add1e54efe16484a9c35 37132e804ccb3fc4ba1f72205da70c3d7a6e66b43178707a9d8ee1156d815c21

IPv4 Address

176.65.148.186 64.89.163.131 45.142.154.102 152.32.240.95 64.89.163.159 84.200.87.36 64.89.163.140

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (3)

M1018 User Account Management M1038 Execution Prevention M1047 Audit

Installation (13)

M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1027 Password Policies +8 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (9)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1027 Password Policies +4 more

Detection Coverage

15 strategies

6/7 stages covered

Reconnaissance (1)

DET0817 Detection of Scanning IP Blocks

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0290 Cross-Platform Detection of Cron Job Abu... DET0384 Behavioral Detection of Unix Shell Execu...

Installation (5)

DET0129 Domain Account Enumeration Across Platfo... DET0253 Detection of Systemd Service Creation or... DET0354 Behavior-chain detection for T1133 Exter... DET0460 Credential Stuffing Detection via Reused... DET0551 Password Guessing via Multi-Source Authe...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (4)

DET0146 Detection of Data Destruction Across Pla... DET0267 Resource Hijacking Detection Strategy DET0343 Direct Network Flood Detection across Ia... DET0546 Detection of Abused or Compromised Cloud...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

nexus team

Type: Unknown Active

tracked as APT-C-41 Promethium TargetCompany FARGO

Infrastructure 28 IOC(s)

50%

Domain

www.nexuspolicyinstitute.org Mirai.AEH ELF.Mirai.ATL Mirai.EGX TBK.DVR.SOSTREAMAX.Command.Injection +16

IPv4 Address

176.65.148.186 64.89.163.131 45.142.154.102 152.32.240.95 64.89.163.159 +2

Artifacts (10)

S.Bailey@bath.ac.uk ftp.exe powershell.exe cmd.exe 1dt2-jz5ox0c7.js sqlservr.exe +4

Capability

50%

15 technique(s) 45 tool(s)/malware 36 CVE(s)

3CX Backdoor 404 Keylogger Botnets Bulletproof hosting CALENDAR Chaos Cobalt Cobalt Strike +37

command and control

T1105

credential access

T1110.001 T1110.004

discovery

T1087.002

execution

T1053.003 T1059.003 T1059.004

Victim

70%

Targeted Sectors

information-technology telecommunications energy defense mining government education pharmaceutical

Targeted Countries

US CN VN AU KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.001

Capability (Malware)

3CX Backdoor 404 Keylogger Botnets

Infrastructure

www.nexuspolicyinstitute.org Mirai.AEH ELF.Mirai.ATL

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

3CX Backdoor 404 Keylogger Botnets

Infrastructure

www.nexuspolicyinstitute.org Mirai.AEH ELF.Mirai.ATL

4 Exploitation

Capability (Techniques)

T1053.003 T1059.003 T1059.004

Capability (Malware)

3CX Backdoor 404 Keylogger Botnets

Infrastructure

www.nexuspolicyinstitute.org Mirai.AEH ELF.Mirai.ATL

5 Installation

Capability (Techniques)

T1110.001 T1110.004 T1087.002 T1133 T1543.002

Capability (Malware)

3CX Backdoor 404 Keylogger Botnets

Infrastructure

www.nexuspolicyinstitute.org Mirai.AEH ELF.Mirai.ATL

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

3CX Backdoor 404 Keylogger Botnets

Infrastructure

www.nexuspolicyinstitute.org Mirai.AEH ELF.Mirai.ATL

7 Actions on Objectives

Capability (Techniques)

T1485 T1496 T1498.001

Capability (Malware)

3CX Backdoor 404 Keylogger Botnets

Infrastructure