Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GreyVibe (threat actor)

Risk

Medium

6 techniques 42 tools/malware 1 vulnerabilities 2 IOCs 3/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1588

Obtain Capabilities resource development

T1588.001

Malware resource development

›

3 Delivery

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

CVE CVE-2026-50522

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (42)

AppDomainManager BITS C2 infrastructure ClickFix Custom malware GitHub Google Drive Group Policy Hive Hook Interception KongTuke LegionRelay MSBuild Matrix Microsoft Teams Msiexec Nexus Payload Payload PhantomRelay Phishing emails PowerShell PowerShell scripts Process Hollowing RAR archives Rogue Spear-phishing Spear-phishing emails Telegram TrickBot Turla Web Shell WhatsApp Windows Command Shell XMRIG XMRIG Miner inter mshta netsh phishing systemd

Indicators of Compromise (2)

Domain

frontforce.org obligations.No

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Detection Coverage

6 strategies

3/7 stages covered

Weaponization (3)

DET0845 Detection of Malware DET0850 Detection of Obtain Capabilities DET0895 Detection of Acquire Infrastructure

Delivery (2)

DET0070 Detection Strategy for Phishing across p... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GreyVibe

Type: Unknown Active

tracked as PrincessClub PhantomRelayV1 LegionRelay on Windows Google's Gemini

Infrastructure 2 IOC(s)

50%

Domain

frontforce.org obligations.No

Capability

50%

6 technique(s) 42 tool(s)/malware 1 CVE(s)

AppDomainManager BITS C2 infrastructure ClickFix Custom malware GitHub Google Drive Group Policy +34

execution

T1059

initial access

T1566 T1566.001

resource development

T1583 T1588 T1588.001

Victim

70%

Targeted Sectors

government defense pharmaceutical media energy

Targeted Countries

RU UA PL

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1588 T1588.001

Capability (Malware)

AppDomainManager BITS C2 infrastructure

Infrastructure

frontforce.org obligations.No

3 Delivery

Capability (Techniques)

T1566 T1566.001

Capability (Malware)

AppDomainManager BITS C2 infrastructure

Infrastructure

frontforce.org obligations.No

4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

AppDomainManager BITS C2 infrastructure

Infrastructure

frontforce.org obligations.No