Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

helix (threat actor)

Risk

High

18 techniques 46 tools/malware 0 vulnerabilities 3 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1204

User Execution execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

T1204.003

Malicious Image execution

T1204.004

Malicious Copy and Paste execution

T1204.005

Malicious Library execution

›

5 Installation

T1007

System Service Discovery discovery

›

6 Command & Control

T1113

Screen Capture collection

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T0172

T1050

Stage risk: Critical High Medium None

Tools & Malware (46)

APT38 AppleJeus BackConfig Backdoors Bazar Bumblebee ChinaChopper Cobalt Cobalt Strike Confucius EVILNUM Emotet Global Gootloader Grandoreiro GuLoader Hancitor Helminth ISMAgent ISMDoor Latrodectus Lazyscripter Machete Malicious files Meow MuddyWater NETWIRE ObliqueRAT OilRig OutSteel PlugX Pony PowerShell QUADAGENT QakBot Qilin RedCurl STOP SentinelOne SideWinder Snip3 SocGholish Spear-phishing Squirrelwaffle TSCookie phishing

Indicators of Compromise (3)

Domain

vnd.openxmlformats-officedocument.spreadsheetml.sheet helix.rest.server.filters.CORSFilter

Filename

ics-attack-v9.0.xlsx

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (11)

M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more

Actions on Objectives (2)

M1031 Network Intrusion Prevention M1057 Data Loss Prevention

Detection Coverage

16 strategies

5/7 stages covered

Delivery (4)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (9)

DET0066 User Execution – Malicious Link (click →... DET0202 Behavioral Detection of Windows Command... DET0248 User Execution – Malicious Image (contai... DET0252 User-Initiated Malicious Library Install... DET0294 User Execution – Malicious File via down... +4 more

Installation (1)

DET0483 Detection of System Service Discovery Co...

Command & Control (1)

DET0346 Detect Screen Capture via Commands and A...

Actions on Objectives (1)

DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

helix

Type: Unknown First seen: 2026 Active

UNC7761 OilRig Helix Kitten APT34 HELIX KITTEN +13 more

Infrastructure 2 IOC(s)

50%

Domain

vnd.openxmlformats-officedocument.spreadsheetml.sheet helix.rest.server.filters.CORSFilter

Artifacts (1)

ics-attack-v9.0.xlsx

Capability

50%

18 technique(s) 46 tool(s)/malware

APT38 AppleJeus BackConfig Backdoors Bazar Bumblebee ChinaChopper Cobalt +38

T0172 T1050

collection

T1113

discovery

T1007

execution

T1059 T1059.001 T1059.003 T1204 +5

Victim

70%

Targeted Sectors

government telecommunications defense financial-services healthcare aerospace energy manufacturing media non-profit education maritime think-tank

Targeted Countries

IR TW CN AE US UA SA ES PK JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

First Seen

2026-08-07

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1190 T1566.001 T1566.002

Capability (Malware)

APT38 AppleJeus BackConfig

Infrastructure

vnd.openxmlformats-officedocument.spreadsheetml.sheet helix.rest.server.filters.CORSFilter

4 Exploitation

Capability (Techniques)

T1059 T1059.001 T1059.003 T1204 T1204.001

Capability (Malware)

APT38 AppleJeus BackConfig

Infrastructure

vnd.openxmlformats-officedocument.spreadsheetml.sheet helix.rest.server.filters.CORSFilter

5 Installation

Capability (Techniques)

T1007

Capability (Malware)

APT38 AppleJeus BackConfig

Infrastructure

vnd.openxmlformats-officedocument.spreadsheetml.sheet helix.rest.server.filters.CORSFilter

6 Command & Control

Capability (Techniques)

T1113

Capability (Malware)

APT38 AppleJeus BackConfig

Infrastructure

vnd.openxmlformats-officedocument.spreadsheetml.sheet helix.rest.server.filters.CORSFilter

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

APT38 AppleJeus BackConfig

Infrastructure

vnd.openxmlformats-officedocument.spreadsheetml.sheet helix.rest.server.filters.CORSFilter