Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

nblock (threat actor)

Risk

Critical

18 techniques 49 tools/malware 6 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1591

Gather Victim Org Information reconnaissance

T1598.003

Spearphishing Link reconnaissance

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.002

AppleScript execution

T1059.003

Windows Command Shell execution

T1059.004

Unix Shell execution

T1059.005

Visual Basic execution

T1059.006

Python execution

T1059.007

JavaScript execution

T1059.008

Network Device CLI execution

T1059.009

Cloud API execution

T1059.010

AutoHotKey & AutoIT execution

T1059.011

Lua execution

T1059.012

Hypervisor CLI execution

T1059.013

Container CLI/API execution

CVE CVE-2014-0569

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2017-8759

CVE CVE-2025-49704

CVE CVE-2025-49706

›

5 Installation

T1003

OS Credential Dumping credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

T1086

Stage risk: Critical High Medium None

Tools & Malware (49)

Akira BADHATCH Black Basta BlackByte Carbon Cobalt Cobalt Strike ComRAT Emotet Empire Expand Exploit kits Global Gootloader Havoc Hunter KONNI Kimsuky Kovter LockBit Medusa Medusa Ransomware MuddyWater NBlock ransomware Neutrino Nltest OilRig Payload Payload PowerShell PowerShell commands PowerShell scripts PowerShell scripts for execution PowerSploit Qilin Quick Assist RSOX RedCurl RevSocket S3Siphon STOP SeaDuke Sliver Spear-phishing TrickBot Trojan Turla WhatsApp phishing

Indicators of Compromise (40)

Domain

Net.WebClient of.a.known.tracker.test TEMP.Veles Reflection.Assembly Assembly.Load banco.bradesco www.maxtds zapgrande.com +8 more

Filename

powershell.exe reg.exe GPEI-Action-Plan-2026.pdf

SHA-256 Hash

51e5ac323d93505f18ddeaeb44c8b06d3215b346631033b08056d53a1a9b7477 669c4212bb1c65b2957f2ac5e68560ef11457a556d3f156dd0f5a3599d7b6434 16e4f9bf1e877020e8880ffc707ab110662885e78a74c2dbc4a39473d81d3d2b

IPv4 Address

216.244.78.186 217.23.4.32 76.73.1.186 109.235.49.23 208.94.247.50 83.133.125.125 76.73.39.18 95.163.66.195 +10 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (3)

M1017 User Training M1054 Software Configuration M1056 Pre-compromise

Exploitation (10)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention +5 more

Installation (9)

M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more

Detection Coverage

17 strategies

3/7 stages covered

Reconnaissance (2)

DET0878 Detection of Spearphishing Link DET0890 Detection of Gather Victim Org Informati...

Exploitation (14)

DET0063 Cross-Platform Behavioral Detection of P... DET0076 Behavioral Detection of Visual Basic Exe... DET0078 Behavioral Detection of Malicious Cloud... DET0083 Container CLI and API Abuse via Docker/K... DET0101 Detection Strategy for Lua Scripting Abu... +9 more

Installation (1)

DET0234 Credential Dumping via Sensitive Memory...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

nblock

Type: Criminal Sophistication: Medium Active

tracked as MaxTDS by FoxIT InTELL ZeroAccess Sirefef MaxTDS +5 more

Infrastructure 34 IOC(s)

50%

Domain

Net.WebClient of.a.known.tracker.test TEMP.Veles Reflection.Assembly Assembly.Load +11

IPv4 Address

216.244.78.186 217.23.4.32 76.73.1.186 109.235.49.23 208.94.247.50 +13

Artifacts (6)

powershell.exe reg.exe GPEI-Action-Plan-2026.pdf 51e5ac323d93505f18ddeaeb44c8b06d3215b346631033b08056d53a1a9b7477 669c4212bb1c65b2957f2ac5e68560ef11457a556d3f156dd0f5a3599d7b6434 16e4f9bf1e877020e8880ffc707ab110662885e78a74c2dbc4a39473d81d3d2b

Capability

50%

18 technique(s) 49 tool(s)/malware 6 CVE(s)

Akira BADHATCH Black Basta BlackByte Carbon Cobalt Cobalt Strike ComRAT +41

T1086

credential access

T1003

execution

T1059 T1059.001 T1059.002 T1059.003 +10

reconnaissance

T1591 T1598.003

Victim

70%

Targeted Sectors

government financial-services defense telecommunications energy critical-infrastructure non-profit healthcare nuclear oil-gas think-tank maritime media information-technology transportation aerospace hospitality education manufacturing construction

Targeted Countries

UA US IR AE SA LB TW CN BR IL CA MX RU JP BY

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1591 T1598.003

Capability (Malware)

Akira BADHATCH Black Basta

Infrastructure

Net.WebClient of.a.known.tracker.test TEMP.Veles

4 Exploitation

Capability (Techniques)

T1059 T1059.001 T1059.002 T1059.003 T1059.004

Capability (Malware)

Akira BADHATCH Black Basta

Infrastructure

Net.WebClient of.a.known.tracker.test TEMP.Veles

5 Installation

Capability (Techniques)

T1003

Capability (Malware)

Akira BADHATCH Black Basta

Infrastructure

Net.WebClient of.a.known.tracker.test TEMP.Veles