Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

jadepuffer (threat actor)

Risk

High

9 techniques 30 tools/malware 2 vulnerabilities 29 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1053.003

Cron execution

CVE CVE-2021-29441

CVE CVE-2025-3248

›

5 Installation

T1552

Unsecured Credentials credential access

T1606

Forge Web Credentials credential access

›

6 Command & Control

T1071

Application Layer Protocol command and control

›

7 Actions on Objectives

T1485

Data Destruction impact

T1486

Data Encrypted for Impact impact

T1078.001

Default Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (30)

Agentic Ransomware Beacon Crisis Cursor EncForge Expand Exploit code Explorer Gentlemen GitHub Global LAMEHUG Langflow MinIO MySQL Nacos PLAY Payload Payload Phishing emails Prometheus PromptLock Proton SAGE STOP Scheduled Tasks Unknown WhatsApp curl phishing

Indicators of Compromise (29)

Domain

r.stdout Mallory.ai proton.me docker.sock cur.execute pymysql.connect c.cursor c.commit +18 more

IPv4 Address

64.20.53.230 45.131.66.106

URL

http://:4444/beacon

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (13)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +8 more

Exploitation (2)

M1018 User Account Management M1047 Audit

Installation (13)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +8 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (5)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1040 Behavior Prevention on Endpoint M1053 Data Backup

Detection Coverage

9 strategies

5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (1)

DET0290 Cross-Platform Detection of Cron Job Abu...

Installation (2)

DET0260 Detection Strategy for Forged Web Creden... DET0412 Detect Access or Search for Unsecured Cr...

Command & Control (1)

DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (3)

DET0146 Detection of Data Destruction Across Pla... DET0215 Detection of Multi-Platform File Encrypt... DET0465 Detection of Default Account Abuse Acros...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

jadepuffer

Type: Unknown Active

tracked as PROMPTSTEAL reported in July 2025

Infrastructure 29 IOC(s)

50%

Domain

r.stdout Mallory.ai proton.me docker.sock cur.execute +21

IPv4 Address

64.20.53.230 45.131.66.106

URL

http://:4444/beacon

Capability

50%

9 technique(s) 30 tool(s)/malware 2 CVE(s)

Agentic Ransomware Beacon Crisis Cursor EncForge Expand Exploit code Explorer +22

command and control

T1071

credential access

T1552 T1606

execution

T1053.003

impact

T1485 T1486

Victim

70%

Targeted Sectors

defense financial-services education government critical-infrastructure media healthcare

Targeted Countries

GB KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.002

Capability (Malware)

Agentic Ransomware Beacon Crisis

Infrastructure

r.stdout Mallory.ai proton.me

4 Exploitation

Capability (Techniques)

T1053.003

Capability (Malware)

Agentic Ransomware Beacon Crisis

Infrastructure

r.stdout Mallory.ai proton.me

5 Installation

Capability (Techniques)

T1552 T1606

Capability (Malware)

Agentic Ransomware Beacon Crisis

Infrastructure

r.stdout Mallory.ai proton.me

6 Command & Control

Capability (Techniques)

T1071

Capability (Malware)

Agentic Ransomware Beacon Crisis

Infrastructure

r.stdout Mallory.ai proton.me

7 Actions on Objectives

Capability (Techniques)

T1485 T1486

Capability (Malware)

Agentic Ransomware Beacon Crisis

Infrastructure

r.stdout Mallory.ai proton.me