Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

cavern manticore (threat actor)

Risk

Critical

9 techniques 48 tools/malware 11 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1585

Establish Accounts resource development

›

3 Delivery

T1566

Phishing initial access

›

4 Exploitation

CVE CVE-2025-3248

CVE CVE-2025-34291

CVE CVE-2025-52691

CVE CVE-2025-54068

CVE CVE-2025-68613

CVE CVE-2025-9316

CVE CVE-2026-11405

CVE CVE-2026-45659

CVE CVE-2026-48282

CVE CVE-2026-50522

CVE CVE-2026-53359

›

5 Installation

T1110

Brute Force credential access

›

6 Command & Control

T1102

Web Service command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1491

Defacement impact

T1498

Network Denial of Service impact

T1070.004

File Deletion stealth

T1140

Deobfuscate/Decode Files or Information stealth

Stage risk: Critical High Medium None

Tools & Malware (48)

AdWind AppDomainManager Backdoors Beacon BiBi C2 infrastructure CALENDAR CROSSWALK Donut Expand Ferocious Gaslight GitHub Global Handala Hermes Hermes AI Agent Hive Karma Kiro Langflow Leverage Mango MarkiRAT MuddyWater Nexus NightLedger Nimbus Manticore OilRig Pay2Key Payload Payload Remote Management Software Rogue STOP SentinelOne Sliver Smoke Sandstorm Stuxnet Telegram UNC1549 Void WhatsApp Wiper malware npm packages phishing route sqlmap

Indicators of Compromise (39)

Domain

fileName.StartsWith ASP.NET Assembly.Load macOS.Gaslight threadlinqs.com ApiEx.DatabaseBrowser System.Diagnostics System.IO +22 more

Filename

n-HTCommp.dll mhm.dll n-ten.dll uxtheme.dll db.dll ode.dll HTCommp.dll WinDirStat.exe +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

13 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (6)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more

Installation (4)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies

Command & Control (3)

M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1037 Filter Network Traffic M1053 Data Backup

Detection Coverage

9 strategies

5/7 stages covered

Weaponization (1)

DET0873 Detection of Establish Accounts

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Installation (1)

DET0463 Brute Force Authentication Failures with...

Command & Control (2)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0425 Suspicious Use of Web Services for C2

Actions on Objectives (4)

DET0140 Behavioral Detection of Malicious File D... DET0238 Defacement via File and Web Content Modi... DET0275 Detect Adversary Deobfuscation or Decodi... DET0518 Behavioral Detection of T1498 – Network...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

cavern manticore

Type: Unknown Active

tracked as Hyadina Model Diplomat Jul 7 2026 Ferocious Kitten +25 more

Infrastructure 30 IOC(s)

50%

Domain

fileName.StartsWith ASP.NET Assembly.Load macOS.Gaslight threadlinqs.com +25

Artifacts (9)

n-HTCommp.dll mhm.dll n-ten.dll uxtheme.dll db.dll ode.dll +3

Capability

50%

9 technique(s) 48 tool(s)/malware 11 CVE(s)

AdWind AppDomainManager Backdoors Beacon BiBi C2 infrastructure CALENDAR CROSSWALK +40

command and control

T1102 T1105

credential access

T1110

impact

T1491 T1498

initial access

T1566

Victim

70%

Targeted Sectors

government financial-services defense education energy media non-profit telecommunications transportation information-technology healthcare aviation nuclear

Targeted Countries

Israel IR IL US AE EG UA CN SA IQ DE CA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1585

Capability (Malware)

AdWind AppDomainManager Backdoors

Infrastructure

fileName.StartsWith ASP.NET Assembly.Load

3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

AdWind AppDomainManager Backdoors

Infrastructure

fileName.StartsWith ASP.NET Assembly.Load

5 Installation

Capability (Techniques)

T1110

Capability (Malware)

AdWind AppDomainManager Backdoors

Infrastructure

fileName.StartsWith ASP.NET Assembly.Load

6 Command & Control

Capability (Techniques)

T1102 T1105

Capability (Malware)

AdWind AppDomainManager Backdoors

Infrastructure

fileName.StartsWith ASP.NET Assembly.Load

7 Actions on Objectives

Capability (Techniques)

T1491 T1498

Capability (Malware)

AdWind AppDomainManager Backdoors

Infrastructure

fileName.StartsWith ASP.NET Assembly.Load