Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

khmer shadow (threat actor)

Risk

Critical

13 techniques 51 tools/malware 17 vulnerabilities 38 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1584

Compromise Infrastructure resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1195

Supply Chain Compromise initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

CVE CVE-2023-33538

CVE CVE-2023-46604

CVE CVE-2024-3183

CVE CVE-2025-0921

CVE CVE-2025-4404

CVE CVE-2025-54068

CVE CVE-2026-0227

CVE CVE-2026-0257

CVE CVE-2026-1731

CVE CVE-2026-21509

CVE CVE-2026-22769

CVE CVE-2026-26980

CVE CVE-2026-33626

CVE CVE-2026-34197

CVE CVE-2026-35616

CVE CVE-2026-39987

CVE CVE-2026-55255

›

5 Installation

T1555

Credentials from Password Stores credential access

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1556

Modify Authentication Process defense impairment

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (51)

Agent Tesla C2 infrastructure ClickFix Custom Loader Dark Device code phishing Gentlemen GitHub Global Havoc Havoc C2 Havoc Demon Havoc Demon payload Hive Infostealer Interlock Kali365 KaynLdr Kimsuky LockBit LucidRook Malwarebytes Matryoshka Medusa Ransomware Miasma Microsoft Teams MuddyWater NIGHTFORGE NIGHTFORGE loader Nexus OceanLotus PLAY Payload Payload Persistence mechanisms Phishing campaigns PowerShell Qilin RUSTCLOAK Remcos Remcos RAT Scheduled Tasks Shai-Hulud Telegram Trojan VMwareNamespaceCmd.exe Vidar WhatsApp Winrar npm packages phishing

Indicators of Compromise (38)

Domain

cloudapi.stream linkednewsapi.top sharingfile.cloud www.sharingfile.cloud ANY.RUN BI.ZONE Sekoia.io macOS.Gaslight +11 more

Email Address

commercial@malwarepatrol.net

Filename

VMwareNamespaceCmd.exe Proposal.zip Node.js Ykzrh.exe smveo-csharp-agent.exe ntdll.dll pdf.exe dui70.dll +2 more

MD5 Hash

03e7a4065df354a99add76e8ba7dd37b

SHA-1 Hash

04e7a98fb3b7738cca42557c3e2d9906d04fa2f6

SHA-256 Hash

1852120a84a328edd1995e633dfd2009867898a8e3f0b385e2490cf21c77a994 90bbfa9e7af176b85d110f4f1789cae6777fcb60813b047133c8f12caa344a17 b3e853eee14fb7948c6907888ee07139085ba9af4231c30e97ff6236b86ca024 15278c52f4e0d8b5bbfe288a5e826ab2ebeaedb7fb85572940cf1263e384761f

IPv4 Address

193.169.240.38 104.193.255.99

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (18)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +13 more

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (3)

M1026 Privileged Account Management M1027 Password Policies M1051 Update Software

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (12)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1025 Privileged Process Integrity +7 more

Detection Coverage

13 strategies

6/7 stages covered

Weaponization (2)

DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Installation (1)

DET0430 Detect Credentials Access from Password...

Command & Control (2)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (3)

DET0104 Detect Modification of Authentication Pr... DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

khmer shadow

Type: Unknown Active

NIGHTFORGE tracked as Wayang Kulit BibiLeaks Prabu Bratana +15 more

Infrastructure 21 IOC(s)

50%

Domain

cloudapi.stream linkednewsapi.top sharingfile.cloud www.sharingfile.cloud ANY.RUN +14

IPv4 Address

193.169.240.38 104.193.255.99

Artifacts (17)

commercial@malwarepatrol.net VMwareNamespaceCmd.exe Proposal.zip Node.js Ykzrh.exe smveo-csharp-agent.exe +11

Capability

50%

13 technique(s) 51 tool(s)/malware 17 CVE(s)

Agent Tesla C2 infrastructure ClickFix Custom Loader Dark Device code phishing Gentlemen GitHub +43

command and control

T1071 T1105

credential access

T1555

defense impairment

T1556

execution

T1059

Victim

70%

Targeted Sectors

defense government financial-services healthcare critical-infrastructure construction telecommunications media energy education manufacturing legal-services oil-gas gaming mining retail information-technology hospitality non-profit

Targeted Countries

Cambodia US CN KP IR IN KR TW PK JP UA AE SG CA BR VN RU IL GB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1584

Capability (Malware)

Agent Tesla C2 infrastructure ClickFix

Infrastructure

cloudapi.stream linkednewsapi.top sharingfile.cloud

3 Delivery

Capability (Techniques)

T1190 T1195 T1566 T1566.001

Capability (Malware)

Agent Tesla C2 infrastructure ClickFix

Infrastructure

cloudapi.stream linkednewsapi.top sharingfile.cloud

4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

Agent Tesla C2 infrastructure ClickFix

Infrastructure

cloudapi.stream linkednewsapi.top sharingfile.cloud

5 Installation

Capability (Techniques)

T1555

Capability (Malware)

Agent Tesla C2 infrastructure ClickFix

Infrastructure

cloudapi.stream linkednewsapi.top sharingfile.cloud

6 Command & Control

Capability (Techniques)

T1071 T1105

Capability (Malware)

Agent Tesla C2 infrastructure ClickFix

Infrastructure

cloudapi.stream linkednewsapi.top sharingfile.cloud