Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

op-512 (threat actor)

Risk

High

7 techniques 57 tools/malware 2 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1195.001

Compromise Software Dependencies and Development Tools initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

CVE CVE-2022-22965

CVE CVE-2026-45336

›

5 Installation

T1552

Unsecured Credentials credential access

T1547.006

Kernel Modules and Extensions persistence

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

Stage risk: Critical High Medium None

Tools & Malware (57)

AWS SDK BadPotato Beacon Bitwarden/cli malicious package Bun JavaScript runtime Bun runtime C2 infrastructure CryptNET Custom web shell framework EfsPotato Expand GitHub GitHub CLI Global Hook Kiro Legitimate Software Leverage LockFile LunarWeb Malicious files Miasma Miasma RAT Mini Shai-Hulud Mini Shai‑Hulud Network monitoring tools Nexus Node.js Payload Payload Phishing campaigns Phishing emails Proton ROKRAT RansomHub RogueRobin STOP Shai-Hulud Shai‑Hulud worm Spear Phishing Campaigns Spear-phishing Spear-phishing Campaigns SweetPotato Trojan Volatility Web Shell Web Shells Wicked WildFire XCSSET malware distribution npm CLI tool npm packages phishing route systemd whoami

Indicators of Compromise (40)

Domain

audit.checkmarx.cx vnd.openxmlformats-officedocument.spreadsheetml.sheet process.env setup.mjs process.platform release.yml registry.npmjs.org format-check.yml +14 more

Email Address

claude@users.noreply.github.com

Filename

execution.js validator.js enterprise-attack-v18.1-analytics.xlsx index.js utils.js enterprise-attack-v18.1-campaigns.xlsx bun.exe sync.js +3 more

SHA-1 Hash

3eab3ec9304aa26081358330491d3cfeb55cc245 79ac49eedf774dd4b0cfa308722bc463cfe5885c

IPv4 Address

85.137.53.71 94.154.172.43

URL

http://:8080/api/v1/file-result http://:8080/api/v1/beacon

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (4)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1033 Limit Software Installation M1051 Update Software

Exploitation (1)

M1038 Execution Prevention

Installation (14)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1031 Network Intrusion Prevention M1057 Data Loss Prevention

Detection Coverage

7 strategies

5/7 stages covered

Delivery (1)

DET0009 Supply-chain tamper in dependencies/dev-...

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Installation (2)

DET0412 Detect Access or Search for Unsecured Cr... DET0450 Detection Strategy for Kernel Modules an...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

op-512

Type: Unknown Active

tracked as persistence remote access

Infrastructure 26 IOC(s)

50%

Domain

audit.checkmarx.cx vnd.openxmlformats-officedocument.spreadsheetml.sheet process.env setup.mjs process.platform +17

IPv4 Address

85.137.53.71 94.154.172.43

URL

http://:8080/api/v1/file-result http://:8080/api/v1/beacon

Artifacts (14)

claude@users.noreply.github.com execution.js validator.js enterprise-attack-v18.1-analytics.xlsx index.js utils.js +8

Capability

50%

7 technique(s) 57 tool(s)/malware 2 CVE(s)

AWS SDK BadPotato Beacon Bitwarden/cli malicious package Bun JavaScript runtime Bun runtime C2 infrastructure CryptNET +49

command and control

T1071.001 T1105

credential access

T1552

execution

T1059.003

exfiltration

T1041

Victim

70%

Targeted Sectors

government telecommunications information-technology aerospace energy financial-services healthcare hospitality defense critical-infrastructure

Targeted Countries

CN RU VN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1195.001

Capability (Malware)

AWS SDK BadPotato Beacon

Infrastructure

audit.checkmarx.cx vnd.openxmlformats-officedocument.spreadsheetml.sheet process.env

4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

AWS SDK BadPotato Beacon

Infrastructure

audit.checkmarx.cx vnd.openxmlformats-officedocument.spreadsheetml.sheet process.env

5 Installation

Capability (Techniques)

T1552 T1547.006

Capability (Malware)

AWS SDK BadPotato Beacon

Infrastructure

audit.checkmarx.cx vnd.openxmlformats-officedocument.spreadsheetml.sheet process.env

6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

AWS SDK BadPotato Beacon

Infrastructure

audit.checkmarx.cx vnd.openxmlformats-officedocument.spreadsheetml.sheet process.env

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AWS SDK BadPotato Beacon

Infrastructure

audit.checkmarx.cx vnd.openxmlformats-officedocument.spreadsheetml.sheet process.env