Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

x3d miner (threat actor)

Risk

High

6 techniques 54 tools/malware 40 vulnerabilities 39 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

CVE CVE-2013-4786

CVE CVE-2017-17215

CVE CVE-2017-7269

CVE CVE-2020-8515

CVE CVE-2021-3156

CVE CVE-2021-4034

CVE CVE-2025-55182

CVE CVE-2025-66376

CVE CVE-2025-68686

CVE CVE-2026-10520

CVE CVE-2026-12569

CVE CVE-2026-16804

CVE CVE-2026-16805

CVE CVE-2026-16806

CVE CVE-2026-16807

CVE CVE-2026-16812

CVE CVE-2026-35273

CVE CVE-2026-44231

CVE CVE-2026-46817

CVE CVE-2026-48586

CVE CVE-2026-48907

CVE CVE-2026-49158

CVE CVE-2026-50522

CVE CVE-2026-55969

CVE CVE-2026-56164

CVE CVE-2026-57978

CVE CVE-2026-57989

CVE CVE-2026-57990

CVE CVE-2026-58023

CVE CVE-2026-59551

CVE CVE-2026-59686

CVE CVE-2026-59687

CVE CVE-2026-59688

CVE CVE-2026-59689

CVE CVE-2026-59690

CVE CVE-2026-60137

CVE CVE-2026-63030

CVE CVE-2026-63048

CVE CVE-2026-64600

CVE CVE-2026-8376

›

5 Installation

T1110

Brute Force credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

T1048

Exfiltration Over Alternative Protocol exfiltration

T1027

Obfuscated Files or Information stealth

T1574.002

Stage risk: Critical High Medium None

Tools & Malware (54)

Akira Anubis BURNYBEAR CALENDAR ChonkyChicken ClickFix Cobalt Cobalt Strike Codex Device code phishing EvilTokens Factory-v3 framework Factory‑v3 framework Gentlemen GitHub Global Hades Hermes Infostealer LUNCHPOKE Langflow ML.Cloud Malicious loader binaries Malwarebytes Mars Media Land MuddyWater Payload Payload PowerShell Proton Qilin Remcos Remcos RAT Rogue RoundCube STOP SectopRAT Shai-Hulud SocGholish Telegram Telegram Bot TinyEgg Vidar Vidar Stealer Vidar stealer WhatsApp WildFire XMRIG XMRig curl npm packages phishing route

Indicators of Compromise (39)

Domain

cvefeed.io ms365-live.com mgwthmc2.dat radiocsirt.org radiocsirt.substack.com FIRST.org Context.ai Hunt.io +9 more

Email Address

radiocsirt@gmail.com

Filename

HTTP.sys Node.js kernel32.dll MicrosoftEdgeUpdate.exe NisSrv.exe MpClient.dll MicrosoftUpdate.exe amsi.dll +5 more

SHA-1 Hash

ab92f731ab20774dfdb95664ee41a2fbafe2a284

IPv4 Address

116.203.243.208 136.243.203.111 136.243.203.109 138.199.246.13 7.2.54.19 7.2.63.3 7.1.35.16

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (4)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1030 Network Segmentation M1031 Network Intrusion Prevention +5 more

Detection Coverage

5 strategies

3/7 stages covered

Exploitation (2)

DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri...

Installation (1)

DET0463 Brute Force Authentication Failures with...

Actions on Objectives (2)

DET0131 Behavioral Detection Strategy for Exfilt... DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

x3d miner

Type: Unknown Active

tracked as MuddyWater education legal insurance +4 more

Infrastructure 24 IOC(s)

50%

Domain

cvefeed.io ms365-live.com mgwthmc2.dat radiocsirt.org radiocsirt.substack.com +12

IPv4 Address

116.203.243.208 136.243.203.111 136.243.203.109 138.199.246.13 7.2.54.19 +2

Artifacts (15)

radiocsirt@gmail.com HTTP.sys Node.js kernel32.dll MicrosoftEdgeUpdate.exe NisSrv.exe +9

Capability

50%

6 technique(s) 54 tool(s)/malware 40 CVE(s)

Akira Anubis BURNYBEAR CALENDAR ChonkyChicken ClickFix Cobalt Cobalt Strike +46

T1574.002

credential access

T1110

execution

T1059 T1059.001

exfiltration

T1048

Victim

70%

Targeted Sectors

financial-services defense government media healthcare manufacturing critical-infrastructure hospitality education utilities mining information-technology energy non-profit food-agriculture entertainment transportation maritime construction aviation telecommunications

Targeted Countries

United States of America FR IR CN RU TW AU BY GB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1059 T1059.001

Capability (Malware)

Akira Anubis BURNYBEAR

Infrastructure

cvefeed.io ms365-live.com mgwthmc2.dat

5 Installation

Capability (Techniques)

T1110

Capability (Malware)

Akira Anubis BURNYBEAR

Infrastructure

cvefeed.io ms365-live.com mgwthmc2.dat

7 Actions on Objectives

Capability (Techniques)

T1048

Capability (Malware)

Akira Anubis BURNYBEAR

Infrastructure

cvefeed.io ms365-live.com mgwthmc2.dat