Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

deadlock (threat actor)

Risk

Critical

40 techniques 45 tools/malware 19 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1106

Native API execution

T1203

Exploitation for Client Execution execution

T1559

Inter-Process Communication execution

T1559.001

Component Object Model execution

T1559.002

Dynamic Data Exchange execution

T1559.003

XPC Services execution

T1569.002

Service Execution execution

T1609

Container Administration Command execution

T1610

Deploy Container execution

T1648

Serverless Execution execution

T1651

Cloud Administration Command execution

T1674

Input Injection execution

T1675

ESXi Administration Command execution

T1677

Poisoned Pipeline Execution execution

T1548.002

Bypass User Account Control privilege escalation

CVE CVE-2019-6693

CVE CVE-2021-27877

CVE CVE-2021-27878

CVE CVE-2021-40539

CVE CVE-2021-4149

CVE CVE-2023-4966

CVE CVE-2024-21762

CVE CVE-2024-3400

CVE CVE-2024-37085

CVE CVE-2024-40766

CVE CVE-2024-42153

CVE CVE-2024-51324

CVE CVE-2024-55591

CVE CVE-2025-31161

CVE CVE-2025-31324

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-61882

CVE CVE-2025-8088

›

5 Installation

T1018

Remote System Discovery discovery

T1033

System Owner/User Discovery discovery

T1046

Network Service Discovery discovery

T1069.002

Domain Groups discovery

›

6 Command & Control

T1102

Web Service command and control

T1219.002

Remote Desktop Software command and control

T1021.001

Remote Desktop Protocol lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1486

Data Encrypted for Impact impact

T1489

Service Stop impact

T1490

Inhibit System Recovery impact

T1070.004

File Deletion stealth

T1078

Valid Accounts stealth

T1197

BITS Jobs stealth

T1211

Exploitation for Stealth stealth

T1218

System Binary Proxy Execution stealth

T1218.014

MMC stealth

T1574

Hijack Execution Flow stealth

T1562.001

T1562.004

Stage risk: Critical High Medium None

Tools & Malware (45)

AdaptixC2 Akira AnyDesk BITS Babuk Beacon Clop Clop Ransomware CloudFlared Conti DeadLock Ransomware GitHub Global Havoc Hive0154 INC Ransomware Interlock Legitimate Software Leverage LockBit Lynx MedusaLocker Nltest Payload Payload PowerShell PowerShell scripts Qilin RansomHub Ransomware payload Ransomware payloads Raspberry Robin Malware Rclone STOP Scheduled Tasks SystemBC Unknown WarLock WinRM Windows Command Shell Winrar inter netsh phishing systemd

Indicators of Compromise (40)

Domain

reciver.address.slice reciver.pk processes.The ME.F8C6A8.txt Aimlabs.com BABUK.MARIO LOCKBIT.WARLOCK INC.LINUX +5 more

Filename

mmc.exe cmd.exe rundll32.exe sc.exe iexplore.exe SystemSettingsAdminFlows.exe svhost.exe AnyDesk.exe +1 more

MD5 Hash

505d23c7a66a02239056ac3cfed24132 c8e16b76ae25d2f27e581a9bef134ea8 4374eb7807fbcb767ae3a6202b4dd8f8 9a4dcce25a87819585aa0a1dd16186c8

SHA-1 Hash

235d6bdf25437b0b004152a263cb483aac08fd10 e5ba4affd0f49a9e451aa913115cf16b481fe1dc 45f7f7e87d18fbe71745a0cc170ae08571c2ba0d 2204d64b82765db4598714fe8bc6e71a24958a7f

SHA-256 Hash

c9cc95ff8f2998229394dfd31c2bd6b723e826a3ca5e008d2b5be19ba419ae2c be1037fac396cf54fb9e25c48e5b0039b3911bb8426cbf52c9433ba06c0685ce 3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612 3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3

IPv4 Address

94.74.164.207 138.226.236.51

URL

http://nmsneustadtl.ac.at/xml.php http://biggoalsports.co.za/minif.php http:///prrq.php http://envisionreg.com/wp-activate.php

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (22)

M1013 Application Developer Guidance M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +17 more

Installation (3)

M1030 Network Segmentation M1031 Network Intrusion Prevention M1042 Disable or Remove Feature or Program

Command & Control (12)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +7 more

Actions on Objectives (26)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program +21 more

Detection Coverage

38 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (19)

DET0065 Detection Strategy for Container Adminis... DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0224 Detect Abuse of Component Object Model (... DET0232 Detection Strategy for ESXi Administrati... +14 more

Installation (4)

DET0093 Behavioral Detection of User Discovery v... DET0360 Behavioral Detection of Domain Group Dis... DET0376 Behavioral Detection Strategy for Networ... DET0574 Detection Strategy for Remote System Enu...

Command & Control (3)

DET0259 Remote Desktop Software Execution and Be... DET0327 Multi-event Detection Strategy for RDP-B... DET0425 Suspicious Use of Web Services for C2

Actions on Objectives (11)

DET0021 Behavioral Detection for Service Stop ac... DET0081 Detection of Proxy Execution via Trusted... DET0098 Detect abuse of Windows BITS Jobs for do... DET0140 Behavioral Detection of Malicious File D... DET0215 Detection of Multi-Platform File Encrypt... +6 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

deadlock

Type: Criminal Sophistication: Medium First seen: 2026 Active

tracked as Mustang Panda

Infrastructure 19 IOC(s)

50%

Domain

reciver.address.slice reciver.pk processes.The ME.F8C6A8.txt Aimlabs.com +8

IPv4 Address

94.74.164.207 138.226.236.51

URL

http://nmsneustadtl.ac.at/xml.php http://biggoalsports.co.za/minif.php http:///prrq.php http://envisionreg.com/wp-activate.php

Artifacts (21)

mmc.exe cmd.exe rundll32.exe sc.exe iexplore.exe SystemSettingsAdminFlows.exe +15

Capability

50%

40 technique(s) 45 tool(s)/malware 19 CVE(s)

AdaptixC2 Akira AnyDesk BITS Babuk Beacon Clop Clop Ransomware +37

T1562.001 T1562.004

command and control

T1102 T1219.002

defense impairment

T1112

discovery

T1018 T1033 T1046 T1069.002

Victim

70%

Targeted Sectors

utilities government financial-services defense manufacturing telecommunications

Targeted Countries

US IQ IR CN PK TW

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2026-05-22

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

AdaptixC2 Akira AnyDesk

Infrastructure

reciver.address.slice reciver.pk processes.The

4 Exploitation

Capability (Techniques)

T1053 T1059 T1059.001 T1059.003 T1106

Capability (Malware)

AdaptixC2 Akira AnyDesk

Infrastructure

reciver.address.slice reciver.pk processes.The

5 Installation

Capability (Techniques)

T1018 T1033 T1046 T1069.002

Capability (Malware)

AdaptixC2 Akira AnyDesk

Infrastructure

reciver.address.slice reciver.pk processes.The

6 Command & Control

Capability (Techniques)

T1102 T1219.002 T1021.001

Capability (Malware)

AdaptixC2 Akira AnyDesk

Infrastructure

reciver.address.slice reciver.pk processes.The

7 Actions on Objectives

Capability (Techniques)

T1486 T1489 T1490

Capability (Malware)

AdaptixC2 Akira AnyDesk

Infrastructure

reciver.address.slice reciver.pk processes.The