Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

JACKPOT PANDA (threat actor)

Risk

Critical

14 techniques 73 tools/malware 25 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

T1203

Exploitation for Client Execution execution

CVE CVE-2018-4063

CVE CVE-2021-26828

CVE CVE-2022-37055

CVE CVE-2023-52163

CVE CVE-2025-14174

CVE CVE-2025-14611

CVE CVE-2025-14733

CVE CVE-2025-14847

CVE CVE-2025-20393

CVE CVE-2025-32433

CVE CVE-2025-40602

CVE CVE-2025-43529

CVE CVE-2025-48572

CVE CVE-2025-48633

CVE CVE-2025-53770

CVE CVE-2025-55182

CVE CVE-2025-58360

CVE CVE-2025-59374

CVE CVE-2025-59718

CVE CVE-2025-59719

CVE CVE-2025-6218

CVE CVE-2025-62221

CVE CVE-2025-66478

CVE CVE-2025-66644

CVE CVE-2025-8110

›

5 Installation

T1110

Brute Force credential access

T1098

Account Manipulation persistence

T1133

External Remote Services persistence

›

6 Command & Control

T1074.002

Remote Data Staging collection

›

7 Actions on Objectives

T1048

Exfiltration Over Alternative Protocol exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1567.001

Exfiltration to Code Repository exfiltration

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

T1081

T1086

Stage risk: Critical High Medium None

Tools & Malware (73)

ATI-Agent AdobeARM Agent.btz Agent.dne Akira Alphv AnyDesk Backdoors BianLian BlackCat BlackCat BlackMatter BlackSuit Clop Cobalt Cobalt Strike Conti Crisis Custom malware Dark DarkSide Gazer GitHub Global Hermit Hive Jackal Kimsuky LockBit Lynx Malicious VSCode extensions Medusa MiniDionis Mustang Panda Rootkit Mythic Nautilus Net Neuron Nexus Node.js PLAY Payload Phishing campaigns PlayCrypt PowerShell REvil Ransomware variants Rhysida Royal Ryuk STOP SentinelOne Singularity Sliver Snake Social engineering tactics Spear-phishing Systeminfo Tasklist Tavdig Trojan Turla Uroburos Vshell Webshells WhiteBear Wicked Wipbot Zero-day exploits gpresult phishing pwdump wce

Indicators of Compromise (40)

Domain

cisa.gov TEMP.Hermit asset.constants TEMP.Zagros Huntresswindow.dataLayer window.dataLayer window.dataLayer.push css-maio5q.builder +18 more

Filename

builder-registry-Cjb-fbDc.js Next.js Node.js entry.client-xi9AqQZ0.js node.exe chunk-LFPYN7LY-CpxNu6ao.js index-D3Fer45w.js root-CdpfvVMi.js +5 more

IPv4 Address

8.218.67.52

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (4)

M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Installation (11)

M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1027 Password Policies +6 more

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +5 more

Detection Coverage

12 strategies

5/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros...

Installation (3)

DET0096 Account Manipulation Behavior Chain Dete... DET0354 Behavior-chain detection for T1133 Exter... DET0463 Brute Force Authentication Failures with...

Command & Control (1)

DET0071 Detection of Remote Data Staging Prior t...

Actions on Objectives (5)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0318 Detection Strategy for Exfiltration to C... DET0495 Detection Strategy for Financial Theft DET0548 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

JACKPOT PANDA

Type: Unknown Active

other aliases several other aliases Earth Lamia first identified in 2014 0mid16B +85 more

Infrastructure 27 IOC(s)

50%

Domain

cisa.gov TEMP.Hermit asset.constants TEMP.Zagros Huntresswindow.dataLayer +21

IPv4 Address

8.218.67.52

Artifacts (13)

builder-registry-Cjb-fbDc.js Next.js Node.js entry.client-xi9AqQZ0.js node.exe chunk-LFPYN7LY-CpxNu6ao.js +7

Capability

55%

14 technique(s) 73 tool(s)/malware 25 CVE(s)

ATI-Agent AdobeARM Agent.btz Agent.dne Akira Alphv AnyDesk Backdoors +65

T1081 T1086

collection

T1074.002

credential access

T1110

execution

T1059.003 T1203

Victim

70%

Targeted Sectors

financial-services government defense healthcare telecommunications critical-infrastructure education media manufacturing energy aerospace hospitality retail non-profit maritime gaming aviation transportation think-tank legal-services utilities information-technology nuclear entertainment food-agriculture construction mining

Targeted Countries

CN RU IR IN KP UA US BR GB KR PK DE TR VN BY PL TW CA AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

cisa.gov TEMP.Hermit asset.constants

4 Exploitation

Capability (Techniques)

T1059.003 T1203

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

cisa.gov TEMP.Hermit asset.constants

5 Installation

Capability (Techniques)

T1110 T1098 T1133

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

cisa.gov TEMP.Hermit asset.constants

6 Command & Control

Capability (Techniques)

T1074.002

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

cisa.gov TEMP.Hermit asset.constants

7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1567.001 T1486 T1657

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

cisa.gov TEMP.Hermit asset.constants