Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

xpl0itrs (threat actor)

Risk

High

9 techniques 40 tools/malware 7 vulnerabilities 3 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1195.002

Compromise Software Supply Chain initial access

T1199

Trusted Relationship initial access

›

4 Exploitation

CVE CVE-2025-53521

CVE CVE-2026-0300

CVE CVE-2026-4670

CVE CVE-2026-5174

CVE CVE-2026-54121

CVE CVE-2026-6973

CVE CVE-2026-72898

›

5 Installation

T1528

Steal Application Access Token credential access

T1552.001

Credentials In Files credential access

›

6 Command & Control

T1213.003

Code Repositories collection

›

7 Actions on Objectives

T1567.001

Exfiltration to Code Repository exfiltration

T1657

Financial Theft impact

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (40)

ABCDoor ABCDoor backdoor AdWind Anubis Axios Backdoors CanisterWorm Cerberus Chaos ClickFix Clop Crisis Curl Custom backdoors Dark Docker Expand GitHub GitHub Actions Global Infostealer Kubernetes Leverage Malware Microsoft Teams MuddyWater NetDraft OneDrive Open-source tools Rootkit Scheduled Tasks Shai-Hulud Telegram Trojans UAT-8302 Unknown ValleyRAT WildFire phishing phishing emails

Indicators of Compromise (3)

Domain

dog3rj.tech Mega.nz

IPv4 Address

12.8.0.0

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1016 Vulnerability Scanning M1018 User Account Management M1026 Privileged Account Management M1030 Network Segmentation M1032 Multi-factor Authentication +5 more

Installation (6)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1027 Password Policies +1 more

Command & Control (4)

M1017 User Training M1018 User Account Management M1032 Multi-factor Authentication M1047 Audit

Actions on Objectives (9)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +4 more

Detection Coverage

9 strategies

4/7 stages covered

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0309 Compromised software/update chain (insta... DET0488 Detect abuse of Trusted Relationships (t...

Installation (2)

DET0307 Detect Access to Unsecured Credential Fi... DET0515 Detection Strategy for T1528 - Steal App...

Command & Control (1)

DET0263 Detecting Bulk or Anomalous Access to Pr...

Actions on Objectives (3)

DET0318 Detection Strategy for Exfiltration to C... DET0495 Detection Strategy for Financial Theft DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

xpl0itrs

Type: Criminal Sophistication: Medium First seen: 2026 Active

xploitbrokers ShinyHunters CLOP TeamPCP

Infrastructure 3 IOC(s)

50%

Domain

dog3rj.tech Mega.nz

IPv4 Address

12.8.0.0

Capability

50%

9 technique(s) 40 tool(s)/malware 7 CVE(s)

ABCDoor ABCDoor backdoor AdWind Anubis Axios Backdoors CanisterWorm Cerberus +32

collection

T1213.003

credential access

T1528 T1552.001

exfiltration

T1567.001

impact

T1657

Victim

70%

Targeted Sectors

government financial-services critical-infrastructure media education healthcare defense information-technology transportation retail manufacturing construction energy mining

Targeted Countries

US CN TW DE RU IN PL IT SG GB

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2026-06-12

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1195.002 T1199

Capability (Malware)

ABCDoor ABCDoor backdoor AdWind

Infrastructure

dog3rj.tech Mega.nz 12.8.0.0

5 Installation

Capability (Techniques)

T1528 T1552.001

Capability (Malware)

ABCDoor ABCDoor backdoor AdWind

Infrastructure

dog3rj.tech Mega.nz 12.8.0.0

6 Command & Control

Capability (Techniques)

T1213.003

Capability (Malware)

ABCDoor ABCDoor backdoor AdWind

Infrastructure

dog3rj.tech Mega.nz 12.8.0.0

7 Actions on Objectives

Capability (Techniques)

T1567.001 T1657

Capability (Malware)

ABCDoor ABCDoor backdoor AdWind

Infrastructure

dog3rj.tech Mega.nz 12.8.0.0