Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Fishing Elephant (threat actor)

Risk

Medium

0 techniques 40 tools/malware 9 vulnerabilities 22 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2023-23397

CVE CVE-2023-38831

CVE CVE-2024-2617

CVE CVE-2025-4427

CVE CVE-2025-4428

CVE CVE-2025-53690

CVE CVE-2025-53770

CVE CVE-2026-21509

CVE CVE-2026-21513

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Aurora BurrowShell Backdoor CHAR Chollima Cobalt Cobalt Strike Dark DynoWiper FlowerStorm GhostBackDoor GhostEmperor GhostFetch Global Group Policy HTTP_VIP Handala Hydra Hydra Saiga Jackal Kimsuky LNK files Labyrinth LockBit Malware Mirage MuddyWater Nexus OilRig Payload Payload PhantomCore PowerShell Remcos Spear-phishing Spear-phishing emails Telegram Unknown Void phishing phishing emails

Indicators of Compromise (22)

Domain

Mega.nz gouvn.me Mallory.ai Filen.io MEGA.nz dog3rj.tech

Filename

mscorsvc.dll phoneactivate.exe sppc.dll avp.exe w3wp.exe MsMpSrv.exe EndProcess.exe msiexec.exe +8 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Fishing Elephant

Type: Unknown Active

Outrider Tiger APT28 Fancy Bear the Newscaster Team Head Mare +36 more

Infrastructure 6 IOC(s)

50%

Domain

Mega.nz gouvn.me Mallory.ai Filen.io MEGA.nz +1

Artifacts (16)

mscorsvc.dll phoneactivate.exe sppc.dll avp.exe w3wp.exe MsMpSrv.exe +10

Capability

50%

40 tool(s)/malware 9 CVE(s)

Aurora BurrowShell Backdoor CHAR Chollima Cobalt Cobalt Strike Dark DynoWiper +32

Victim

70%

Targeted Sectors

government financial-services defense energy critical-infrastructure manufacturing transportation education telecommunications maritime construction aerospace healthcare retail aviation utilities chemical nuclear media mining food-agriculture

Targeted Countries

CN IN PK US RU DE PL AE KZ UA BR IL MX TR RO GB TW BY NG SA ES IT NL KR JP

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges