Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Teleboyi (threat actor)

Risk

High

3 techniques 47 tools/malware 24 vulnerabilities 60 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

CVE CVE-2009-3960

CVE CVE-2010-2861

CVE CVE-2018-13379

CVE CVE-2019-0604

CVE CVE-2019-3980

CVE CVE-2020-12812

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-41352

CVE CVE-2023-23397

CVE CVE-2023-2868

CVE CVE-2023-32315

CVE CVE-2023-36802

CVE CVE-2023-42793

CVE CVE-2023-48788

CVE CVE-2024-1709

CVE CVE-2024-24919

CVE CVE-2025-0411

CVE CVE-2025-12825

CVE CVE-2025-38067

CVE CVE-2026-20045

CVE CVE-2026-20274

CVE CVE-2026-20860

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1055

Process Injection stealth

T1220

XSL Script Processing stealth

Stage risk: Critical High Medium None

Tools & Malware (47)

Backdoors Beacon Cobalt Cobalt Strike Cobalt Strike BEACON Cring DeputyDog Dexter Explorer FatalRat Global GuLoader Impacket J-magic J‑magic Loki Lumma Stealer Malicious LNK files Meduza Stealer Merlin MintsLoader Mythic NailaoLocker Payload Payload Phishing emails PlugX PlugX RAT Polyglot PowerShell PowerShell scripts QuasarRAT Remcos Sagerunex ShadowPad ShadowPad Malware SlowStepper Stealc Telegram Trojan Unknown VIP Keylogger Visual Studio Code Winnti Winnti malware exfiltration.dll phishing

Indicators of Compromise (60)

Domain

CQHashDumpv2.exe usysdiag.exe mspaint.exe form.rar list.docx filling.pdf.exe RegAsm.exe net.exe +32 more

Email Address

ics-cert@kaspersky.com

Filename

ElysiumO.exe cmd.exe mshta.exe CQHashDumpv2.exe LOC.dll usysdiag.exe mspaint.exe form.rar +11 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

10 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Actions on Objectives (3)

M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Detection Coverage

3 strategies

2/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Actions on Objectives (2)

DET0205 Detect XSL Script Abuse via msxsl and wm... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Teleboyi

Type: Unknown Active

DeputyDog tracked as APT37 Ricochet Chollima ScarCruft +25 more

Infrastructure 40 IOC(s)

50%

Domain

CQHashDumpv2.exe usysdiag.exe mspaint.exe form.rar list.docx +35

Artifacts (20)

ics-cert@kaspersky.com ElysiumO.exe cmd.exe mshta.exe CQHashDumpv2.exe LOC.dll +14

Capability

50%

3 technique(s) 47 tool(s)/malware 24 CVE(s)

Backdoors Beacon Cobalt Cobalt Strike Cobalt Strike BEACON Cring DeputyDog Dexter +39

initial access

T1190

stealth

T1055 T1220

Victim

70%

Targeted Sectors

government financial-services manufacturing telecommunications education energy defense transportation critical-infrastructure pharmaceutical maritime media oil-gas healthcare construction retail nuclear mining entertainment chemical utilities aerospace aviation legal-services

Targeted Countries

CN JP US TW RU UA VN AE KR SG BR GB IL IR AU IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Backdoors Beacon Cobalt

Infrastructure

CQHashDumpv2.exe usysdiag.exe mspaint.exe