Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

wp-shellstorm (threat actor)

Risk

High

7 techniques 54 tools/malware 40 vulnerabilities 25 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.003

Windows Command Shell execution

T1203

Exploitation for Client Execution execution

CVE CVE-2008-4128

CVE CVE-2021-29441

CVE CVE-2023-4346

CVE CVE-2025-68686

CVE CVE-2026-0770

CVE CVE-2026-11405

CVE CVE-2026-12957

CVE CVE-2026-16723

CVE CVE-2026-16812

CVE CVE-2026-20316

CVE CVE-2026-20896

CVE CVE-2026-29059

CVE CVE-2026-3300

CVE CVE-2026-3844

CVE CVE-2026-40138

CVE CVE-2026-40139

CVE CVE-2026-41940

CVE CVE-2026-42533

CVE CVE-2026-42897

CVE CVE-2026-43499

CVE CVE-2026-43503

CVE CVE-2026-45659

CVE CVE-2026-46242

CVE CVE-2026-46331

CVE CVE-2026-46817

CVE CVE-2026-48558

CVE CVE-2026-48907

CVE CVE-2026-50656

CVE CVE-2026-53359

CVE CVE-2026-55255

CVE CVE-2026-59726

CVE CVE-2026-59890

CVE CVE-2026-60137

CVE CVE-2026-63030

CVE CVE-2026-6682

CVE CVE-2026-6688

CVE CVE-2026-6875

CVE CVE-2026-8037

CVE CVE-2026-8451

CVE CVE-2026-8732

›

5 Installation

No data

›

6 Command & Control

T1550.002

Pass the Hash lateral movement

›

7 Actions on Objectives

T1601

Modify System Image defense impairment

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (54)

Antigravity ArcBridge BRAIN Backdoors BadIIS Brain Cipher BridgeHead C0XMO CanisterWorm ClickFix Clipper ConnectWise Evilginx FOFA FOFA search engine Gafgyt GenieLocker GitHub Global Hermes Infostealer Kevin LONGLEASH Langflow Miasma Mirage Mirage Kitten Nacos NetSupport RAT NightLedger Nimbus Manticore Ninja OtterCookie PowerShell Python SimpleHTTPServer SNOWLIGHT SNOWLIGHT dropper ScreenConnect Shai-Hulud SmartLoader SocGholish Trojan Turla TuxBot v3 Evolution VShell VShell backdoor Vidar Void WannaCry Webshells WhatsApp XCSSET down.php phishing

Indicators of Compromise (25)

Domain

Braintree.Net wshu.net binding.gyp xs.xxooonline.eu.cc www.bleepingcomputer.com L-SM-TH.md Newtonsoftt.Json.Net Backdoor.Mistic +10 more

Email Address

info@rescana.com Info@rescana.com

Filename

Node.js

IPv4 Address

2.9.99.5 137.175.93.126 113.196.56.150 43.108.17.80

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (12)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +7 more

Command & Control (4)

M1018 User Account Management M1026 Privileged Account Management M1051 Update Software M1052 User Account Control

Actions on Objectives (11)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +6 more

Detection Coverage

7 strategies

4/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0516 Behavioral Detection of Command and Scri...

Command & Control (1)

DET0409 Detection Strategy for T1550.002 - Pass...

Actions on Objectives (2)

DET0170 Detection Strategy for Modify System Ima... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

wp-shellstorm

Type: Unknown Active

tracked as

Infrastructure 22 IOC(s)

50%

Domain

Braintree.Net wshu.net binding.gyp xs.xxooonline.eu.cc www.bleepingcomputer.com +13

IPv4 Address

2.9.99.5 137.175.93.126 113.196.56.150 43.108.17.80

Artifacts (3)

info@rescana.com Info@rescana.com Node.js

Capability

50%

7 technique(s) 54 tool(s)/malware 40 CVE(s)

Antigravity ArcBridge BRAIN Backdoors BadIIS Brain Cipher BridgeHead C0XMO +46

defense impairment

T1601

execution

T1059 T1059.003 T1203

initial access

T1190

lateral movement

T1550.002

Victim

70%

Targeted Sectors

financial-services retail government healthcare hospitality critical-infrastructure education energy media defense aviation utilities transportation gaming

Targeted Countries

IN CN KP VN AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Antigravity ArcBridge BRAIN

Infrastructure

Braintree.Net wshu.net binding.gyp

4 Exploitation

Capability (Techniques)

T1059 T1059.003 T1203

Capability (Malware)

Antigravity ArcBridge BRAIN

Infrastructure

Braintree.Net wshu.net binding.gyp

6 Command & Control

Capability (Techniques)

T1550.002

Capability (Malware)

Antigravity ArcBridge BRAIN

Infrastructure

Braintree.Net wshu.net binding.gyp