Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Belsen Group (threat actor)

Risk

Critical

47 techniques 45 tools/malware 25 vulnerabilities 56 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1106

Native API execution

T1068

Exploitation for Privilege Escalation privilege escalation

T1548

Abuse Elevation Control Mechanism privilege escalation

CVE CVE-2018-13379

CVE CVE-2018-8453

CVE CVE-2020-1472

CVE CVE-2021-22205

CVE CVE-2021-26084

CVE CVE-2022-40684

CVE CVE-2022-42045

CVE CVE-2022-42475

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2023-27997

CVE CVE-2024-21762

CVE CVE-2024-37085

CVE CVE-2024-40711

CVE CVE-2024-42057

CVE CVE-2024-55591

CVE CVE-2025-26125

CVE CVE-2025-32433

CVE CVE-2025-33073

CVE CVE-2025-59718

CVE CVE-2025-59719

CVE CVE-2026-18577

CVE CVE-2026-24858

CVE CVE-2026-63077

CVE CVE-2026-66066

›

5 Installation

T1003.001

LSASS Memory credential access

T1555.003

Credentials from Web Browsers credential access

T1557.001

Name Resolution Poisoning and SMB Relay credential access

T1018

Remote System Discovery discovery

T1046

Network Service Discovery discovery

T1087

Account Discovery discovery

T1037

Boot or Logon Initialization Scripts persistence

T1133

External Remote Services persistence

T1137

Office Application Startup persistence

T1543.003

Windows Service persistence

T1547

Boot or Logon Autostart Execution persistence

›

6 Command & Control

T1560

Archive Collected Data collection

T1071

Application Layer Protocol command and control

T1090

Proxy command and control

T1219

Remote Access Tools command and control

T1021.001

Remote Desktop Protocol lateral movement

T1021.002

SMB/Windows Admin Shares lateral movement

T1021.004

SSH lateral movement

T1570

Lateral Tool Transfer lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1484.001

Group Policy Modification defense impairment

T1685

Disable or Modify Tools defense impairment

T1048

Exfiltration Over Alternative Protocol exfiltration

T1486

Data Encrypted for Impact impact

T1014

Rootkit stealth

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1036.001

Invalid Code Signature stealth

T1070.003

Clear Command History stealth

T1078

Valid Accounts stealth

T1564

Hide Artifacts stealth

T1574

Hijack Execution Flow stealth

T1043

T1070.001

T1086

T1460

T1549

T1562.001

Stage risk: Critical High Medium None

Tools & Malware (45)

Akira Alphv Avaddon Babuk Bjorka BlackByte BlackMatter BlueSky Cerber ChaCha20 Chaos Cobalt Cobalt Strike Conti Cuba Custom RAT Dark DragonForce Exploit kits FunkSec Gentlemen GitHub Global Globe HELLOKITTY Hive Kevin Knight Kraken LockBit Payload Payload Phishing campaigns Phishing emails PowerShell Qilin REvil Ransomware payload SMB SSH SystemBC WMI Zeppelin phishing rock

Indicators of Compromise (56)

Domain

README.txt File.txt Mallory.ai kitten.gif comsvcs.dll Node.js eb.sys nseckrnl.sys +27 more

Email Address

decrypt@india.com Help244@Ya.RU

Filename

update.exe Node.js comsvcs.dll eb.sys nseckrnl.sys vgk.sys dmx.sys G11.sys +9 more

IPv4 Address

193.233.202.17 85.11.187.8

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

39 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (14)

M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +9 more

Exploitation (15)

M1018 User Account Management M1019 Threat Intelligence Program M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +10 more

Installation (21)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +16 more

Command & Control (14)

M1018 User Account Management M1020 SSL/TLS Inspection M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +9 more

Actions on Objectives (28)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +23 more

Detection Coverage

41 strategies

5/7 stages covered

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult...

Exploitation (7)

DET0202 Behavioral Detection of Windows Command... DET0345 Detection Strategy for Abuse Elevation C... DET0364 Behavioral Detection Strategy for WMI Ex... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut... +2 more

Installation (11)

DET0037 Detect Suspicious Access to Browser Cred... DET0112 Boot or Logon Initialization Scripts Det... DET0274 Boot or Logon Autostart Execution Detect... DET0354 Behavior-chain detection for T1133 Exter... DET0363 Detection of Credential Dumping from LSA... +6 more

Command & Control (8)

DET0183 Detection Strategy for Lateral Tool Tran... DET0327 Multi-event Detection Strategy for RDP-B... DET0444 Detection of Command and Control Over Ap... DET0445 Detection of Proxy Infrastructure Setup... DET0496 Behavior-Chain Detection for Remote Acce... +3 more

Actions on Objectives (13)

DET0031 Invalid Code Signature Execution Detecti... DET0127 Behavioral Detection of Masquerading Acr... DET0131 Behavioral Detection Strategy for Exfilt... DET0165 Behavioral Detection of Command History... DET0215 Detection of Multi-Platform File Encrypt... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Belsen Group

Type: Unknown Active

Belesn Group Emperor Dragonfly tracked as ThreeAM Abyss Locker +57 more

Infrastructure 37 IOC(s)

50%

Domain

README.txt File.txt Mallory.ai kitten.gif comsvcs.dll +30

IPv4 Address

193.233.202.17 85.11.187.8

Artifacts (19)

decrypt@india.com Help244@Ya.RU update.exe Node.js comsvcs.dll eb.sys +13

Capability

50%

47 technique(s) 45 tool(s)/malware 25 CVE(s)

Akira Alphv Avaddon Babuk Bjorka BlackByte BlackMatter BlueSky +37

T1043 T1070.001 T1086 T1460 +2

collection

T1560

command and control

T1071 T1090 T1219

credential access

T1003.001 T1555.003 T1557.001

Victim

70%

Targeted Sectors

healthcare manufacturing financial-services government education telecommunications transportation critical-infrastructure energy retail information-technology defense non-profit media food-agriculture construction mining hospitality aviation pharmaceutical utilities entertainment aerospace legal-services

Targeted Countries

US CA CN BR IN DE KR JP TW FR AE GB RU ES AU TR IT RO MX IL EG SG KP VN IQ IR AZ NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566

Capability (Malware)

Akira Alphv Avaddon

Infrastructure

README.txt File.txt Mallory.ai

4 Exploitation

Capability (Techniques)

T1047 T1053.005 T1059.001 T1059.003 T1106

Capability (Malware)

Akira Alphv Avaddon

Infrastructure

README.txt File.txt Mallory.ai

5 Installation

Capability (Techniques)

T1003.001 T1555.003 T1557.001 T1018 T1046

Capability (Malware)

Akira Alphv Avaddon

Infrastructure

README.txt File.txt Mallory.ai

6 Command & Control

Capability (Techniques)

T1560 T1071 T1090 T1219 T1021.001

Capability (Malware)

Akira Alphv Avaddon

Infrastructure

README.txt File.txt Mallory.ai

7 Actions on Objectives

Capability (Techniques)

T1048 T1486

Capability (Malware)

Akira Alphv Avaddon

Infrastructure

README.txt File.txt Mallory.ai