Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ELUSIVE COMET (threat actor)

Risk

Medium

0 techniques 41 tools/malware 33 vulnerabilities 38 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-9995

CVE CVE-2022-1040

CVE CVE-2022-47966

CVE CVE-2023-24489

CVE CVE-2023-27350

CVE CVE-2023-28121

CVE CVE-2023-3460

CVE CVE-2023-3519

CVE CVE-2023-36884

CVE CVE-2023-38831

CVE CVE-2023-40477

CVE CVE-2024-11859

CVE CVE-2024-27564

CVE CVE-2024-38112

CVE CVE-2024-38193

CVE CVE-2024-42057

CVE CVE-2024-4577

CVE CVE-2024-6670

CVE CVE-2024-6671

CVE CVE-2024-8190

CVE CVE-2024-8963

CVE CVE-2024-9380

CVE CVE-2025-20352

CVE CVE-2025-24472

CVE CVE-2025-26633

CVE CVE-2025-49704

CVE CVE-2025-49706

CVE CVE-2025-53770

CVE CVE-2025-53771

CVE CVE-2025-59287

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (41)

AsyncRAT BITS BlackCat Buhtrap Clop Cobalt Cobalt Strike Custom malware Dark DarkHotel GitHub Global Infostealer Jackal Kimsuky Malwarebytes Matrix Naikon Nexus Nitro Payload Payload Phishing emails PlugX Poseidon PowerShell Remcos Remcos RAT Royal SentinelOne Social engineering tactics Spear-phishing TeamSpy Trojan Tsunami Unknown VICEROY Void gcman npm packages phishing

Indicators of Compromise (38)

Domain

Cyber.Anarchy.Squad internet.ru Crates.io pages.dev Lemmy.world nknews.pro TEMP.Avengers TEMP.Hippo +22 more

Email Address

bloombergconferences@gmail.com

Filename

WinTapix.sys powershell.exe Node.js mshta.exe ssh.exe copy.xls

IPv4 Address

104.248.157.218

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

ELUSIVE COMET

Type: Unknown Active

Fancy Bear Storm-0558 tracked as the Newscaster Team cpyy +81 more

Infrastructure 31 IOC(s)

50%

Domain

Cyber.Anarchy.Squad internet.ru Crates.io pages.dev Lemmy.world +25

IPv4 Address

104.248.157.218

Artifacts (7)

bloombergconferences@gmail.com WinTapix.sys powershell.exe Node.js mshta.exe ssh.exe +1

Capability

50%

41 tool(s)/malware 33 CVE(s)

AsyncRAT BITS BlackCat Buhtrap Clop Cobalt Cobalt Strike Custom malware +33

Victim

70%

Targeted Sectors

government financial-services defense non-profit telecommunications education media energy healthcare aerospace manufacturing critical-infrastructure information-technology retail maritime think-tank transportation oil-gas hospitality legal-services mining nuclear pharmaceutical chemical aviation entertainment utilities gaming construction

Targeted Countries

CN US UA RU TW GB IN JP DE KR IR PK FR CA KP IL SA VN BR KZ PL AE TR AU SG BY ES RO MX NL IT IQ SY EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges