Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

kontraktnik (threat actor)

Risk

High

13 techniques 49 tools/malware 1 vulnerabilities 12 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1588.003

Code Signing Certificates resource development

›

3 Delivery

No data

›

4 Exploitation

T1053.005

Scheduled Task execution

T1106

Native API execution

T1548.002

Bypass User Account Control privilege escalation

CVE CVE-2026-0257

›

5 Installation

T1552.001

Credentials In Files credential access

T1555

Credentials from Password Stores credential access

T1555.003

Credentials from Web Browsers credential access

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1560

Archive Collected Data collection

T1090

Proxy command and control

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

T1562.001

Stage risk: Critical High Medium None

Tools & Malware (49)

Anchor Athena BEARDSHELL BlueNoroff Covenant Custom malware DWAgent Dolphin X Dolphin X RAT Dolphin X Stealer Exodus Expand Explorer GitHub Global Guard Infostealer Infostealer malware Kali365 Kimsuky Kraken MESHAGENT MarkiRAT Nexus Payload Phishing Kit PowerShell PowerShell commands Qilin Qilin Ransomware Remote Management Software Revive Royal SLIMAGENT STOP Scheduled Tasks Sednit Sedreco Starland RAT Telegram Telegram channels Trojan Unknown WhatsApp XAgent curl curl.exe phishing route

Indicators of Compromise (12)

Domain

Domainthedolphinx.topParent h4x.lat portbackend.thedolphinx.top thedolphinx.top backend.thedolphinx.top cisa.gov Academia.edu thehackernews.com +1 more

Filename

curl.exe explorer.exe

SHA-256 Hash

726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Exploitation (8)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Installation (8)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +3 more

Command & Control (4)

M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit

Actions on Objectives (5)

M1017 User Training M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint M1047 Audit M1049 Antivirus/Antimalware

Detection Coverage

12 strategies

5/7 stages covered

Weaponization (1)

DET0875 Detection of Code Signing Certificates

Exploitation (3)

DET0388 Detection Strategy for T1548.002 – Bypas... DET0441 Detection of Suspicious Scheduled Task C... DET0529 Behavioral Detection of Native API Invoc...

Installation (4)

DET0037 Detect Suspicious Access to Browser Cred... DET0307 Detect Access to Unsecured Credential Fi... DET0365 Detect Registry and Startup Folder Persi... DET0430 Detect Credentials Access from Password...

Command & Control (2)

DET0445 Detection of Proxy Infrastructure Setup... DET0526 Detect Archiving and Encryption of Colle...

Actions on Objectives (2)

DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

kontraktnik

Type: Unknown Active

tracked as Open Source Intelligence Fancy Bear Sednit Forest Blizzard +1 more

Infrastructure 9 IOC(s)

50%

Domain

Domainthedolphinx.topParent h4x.lat portbackend.thedolphinx.top thedolphinx.top backend.thedolphinx.top +4

Artifacts (3)

curl.exe explorer.exe 726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0

Capability

50%

13 technique(s) 49 tool(s)/malware 1 CVE(s)

Anchor Athena BEARDSHELL BlueNoroff Covenant Custom malware DWAgent Dolphin X +41

T1562.001

collection

T1560

command and control

T1090

credential access

T1552.001 T1555 T1555.003

Victim

70%

Targeted Sectors

defense financial-services healthcare government transportation maritime energy

Targeted Countries

RU UA US TR AE PL DE IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588.003

Capability (Malware)

Anchor Athena BEARDSHELL

Infrastructure

Domainthedolphinx.topParent h4x.lat portbackend.thedolphinx.top

4 Exploitation

Capability (Techniques)

T1053.005 T1106 T1548.002

Capability (Malware)

Anchor Athena BEARDSHELL

Infrastructure

Domainthedolphinx.topParent h4x.lat portbackend.thedolphinx.top

5 Installation

Capability (Techniques)

T1552.001 T1555 T1555.003 T1547.001

Capability (Malware)

Anchor Athena BEARDSHELL

Infrastructure

Domainthedolphinx.topParent h4x.lat portbackend.thedolphinx.top

6 Command & Control

Capability (Techniques)

T1560 T1090

Capability (Malware)

Anchor Athena BEARDSHELL

Infrastructure

Domainthedolphinx.topParent h4x.lat portbackend.thedolphinx.top