Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
jadeprox (threat actor)
Risk
99
Critical
19 techniques 66 tools/malware 40 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595.002
Vulnerability Scanning reconnaissance
›
2 Weaponization
1
T1583.001
Domains resource development
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
42
T1059.005
Visual Basic execution
T1204.002
Malicious File execution
CVE CVE-2018-11511
CVE CVE-2021-24139
CVE CVE-2021-31755
CVE CVE-2021-32305
CVE CVE-2023-6875
CVE CVE-2024-23897
CVE CVE-2025-26385
CVE CVE-2025-46818
CVE CVE-2025-66430
CVE CVE-2026-0257
CVE CVE-2026-0625
CVE CVE-2026-12569
CVE CVE-2026-12957
CVE CVE-2026-15682
CVE CVE-2026-16232
CVE CVE-2026-22769
CVE CVE-2026-25526
CVE CVE-2026-3102
CVE CVE-2026-34926
CVE CVE-2026-35033
CVE CVE-2026-40369
CVE CVE-2026-41089
CVE CVE-2026-42271
CVE CVE-2026-42897
CVE CVE-2026-44338
CVE CVE-2026-46300
CVE CVE-2026-46817
CVE CVE-2026-4782
CVE CVE-2026-4798
CVE CVE-2026-48172
CVE CVE-2026-48939
CVE CVE-2026-50522
CVE CVE-2026-5140
CVE CVE-2026-52830
CVE CVE-2026-5386
CVE CVE-2026-56291
CVE CVE-2026-58644
CVE CVE-2026-8631
CVE CVE-2026-8632
CVE CVE-2026-9082
›
5 Installation
1
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
3
T1071.001
Web Protocols command and control
T1090.001
Internal Proxy command and control
T1573.001
Symmetric Cryptography command and control
›
7 Actions on Objectives
9
T1027
Obfuscated Files or Information stealth
T1027.013
Encrypted/Encoded File stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1070.004
File Deletion stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218
System Binary Proxy Execution stealth
T1574.001
DLL stealth
T1064
T1064
T1574.002
T1574.002
Stage risk: Critical High Medium None

Tools & Malware (66)

AdaptixC2 Akira Backdoors Beacon Beagle BugSleep Bulletproof hosting CALENDAR ClaimLoader ClickFix Dark Firefox Fooder Fooder loader Fscan Gentlemen GitHub GlassWorm Global Go-proxy Infostealer Leverage MSI installer MacSync Microsoft Teams MuddyWater Neo-reGeorg Nexus Node.js Nuclei PHOTO PLAY Payload Payload Phishing campaigns Phishing emails Phoenix PlugX PowerShell ReGeorg Remcos Rogue STOP ScreenConnect Spear-phishing Stealc StealthCache Suo5 Telegram TriBack Loader Trojan Unknown ValleyRAT Vidar Web Shells Webshells WhatsApp XMRIG bugsleep fscan iox npm packages nuclei phishing reGeorg suo5

Indicators of Compromise (40)

Domain
update-trellix.com license.claude-pro.com gouvvbo.top claude-pro.com sylverixstrategy.com update-crowdstrike.com update-sentinelone.com vertextrust-advisors.com +4 more
Filename
MpClient.dll Claude-Pro-Relay-Technical-Overview.lnk hostfxr.dll avk.dll Claude-Pro-Relay-Technical-Overview.zip del.vbs.bat DeviceSync.zip Claude.vbs +10 more
SHA-256 Hash
5f22f4c4fdb36c4f0ea3248abb00521e39008c1fb4c97e1b4a9c7b9ef0b691c2
IPv4 Address
43.106.71.28 91.195.240.19 104.21.81.7 194.11.246.78 77.91.74.235 162.255.119.28 8.217.190.58 192.252.186.62 +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

23 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (6)
M1017 User Training M1021 Restrict Web-Based Content M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program +1 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (15)
M1013 Application Developer Guidance M1017 User Training M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +10 more

Detection Coverage

17 strategies
7/7 stages covered

Reconnaissance (1)

DET0867 Detection of Vulnerability Scanning

Weaponization (1)

DET0892 Detection of Domains

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0076 Behavioral Detection of Visual Basic Exe... DET0294 User Execution – Malicious File via down...

Installation (1)

DET0365 Detect Registry and Startup Folder Persi...

Command & Control (3)

DET0027 Detection of Web Protocol-Based C2 Over... DET0075 Internal Proxy Behavior via Lateral Host... DET0143 Detection Strategy for Encrypted Channel...

Actions on Objectives (7)

DET0081 Detection of Proxy Execution via Trusted... DET0087 Encrypted or Encoded File Payload Detect... DET0140 Behavioral Detection of Malicious File D... DET0201 Detection Strategy for Hijack Execution... DET0275 Detect Adversary Deobfuscation or Decodi... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

jadeprox

Type: Unknown Active
healthcare JadeProx targeting government Latin America tracked as JadeProx conducted espionage activity +5 more
Infrastructure 21 IOC(s)
50%
Domain
update-trellix.com license.claude-pro.com gouvvbo.top claude-pro.com sylverixstrategy.com +7
IPv4 Address
43.106.71.28 91.195.240.19 104.21.81.7 194.11.246.78 77.91.74.235 +4
Artifacts (19)
MpClient.dll Claude-Pro-Relay-Technical-Overview.lnk hostfxr.dll avk.dll Claude-Pro-Relay-Technical-Overview.zip del.vbs.bat +13
Capability
50%
19 technique(s) 66 tool(s)/malware 40 CVE(s)
AdaptixC2 Akira Backdoors Beacon Beagle BugSleep Bulletproof hosting CALENDAR +58
T1064 T1574.002
command and control
T1071.001 T1090.001 T1573.001
execution
T1059.005 T1204.002
initial access
T1190 T1566.001
Victim
70%

Targeted Sectors

healthcare government education financial-services defense energy telecommunications critical-infrastructure utilities hospitality pharmaceutical media mining manufacturing aviation retail gaming non-profit nuclear transportation maritime aerospace construction

Targeted Countries

CN IR UA SG PL IN VN US JP CA GB KP KR RO RU AU TR AZ SA ES MX FR IT TW BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595.002

Capability (Malware)

AdaptixC2 Akira Backdoors
2 Weaponization

Capability (Techniques)

T1583.001

Capability (Malware)

AdaptixC2 Akira Backdoors
3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

AdaptixC2 Akira Backdoors
4 Exploitation

Capability (Techniques)

T1059.005 T1204.002

Capability (Malware)

AdaptixC2 Akira Backdoors
5 Installation

Capability (Techniques)

T1547.001

Capability (Malware)

AdaptixC2 Akira Backdoors
6 Command & Control

Capability (Techniques)

T1071.001 T1090.001 T1573.001

Capability (Malware)

AdaptixC2 Akira Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.