Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

titan (threat actor)

Risk

Critical

12 techniques 56 tools/malware 6 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.004

Unix Shell execution

T1203

Exploitation for Client Execution execution

CVE CVE-2023-21415

CVE CVE-2023-22527

CVE CVE-2024-1708

CVE CVE-2024-43215

CVE CVE-2026-20131

CVE CVE-2026-50751

›

5 Installation

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1098.004

SSH Authorized Keys persistence

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1574.006

Dynamic Linker Hijacking stealth

Stage risk: Critical High Medium None

Tools & Malware (56)

ALFA TEaM Shell Anubis Atmosphere Aurora Check Point Security Gateway ConnectWise ConnectWise ScreenConnect Conti Custom malware DROPSHOT Dark Exploit kits Explorer GitHub Global Infostealer Lateral movement tools Leverage Lorenz Lynx MacDownloader Pay2Key Payload Payload Persistence mechanisms PowerShell Predator PsExec Qilin REvil Remote Management Software Remote access tools SHAPESHIFT STOP SafePay Scheduled Tasks ScreenConnect Shell Scripts a0-a7 Solar Spear-phishing TURNEDUP Telegram Telegram channels Titan Titan Edge Node Titan Ransomware TurnedUp Unknown Zero-day exploits aleo-pool Client curl libGoworker.so malicious HTA files nuclei phishing schtasks

Indicators of Compromise (40)

Domain

27.Lorenz ip-api.com 23.Lebonnois 24.Vinatier 25.Lunine 26.Elachi Mallory.ai info.log +27 more

Email Address

audit@patchstack.com

Filename

titan.tar.gz

IPv4 Address

3.39.22.13 35.74.215.126 13.236.179.8

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (4)

M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Installation (3)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1042 Disable or Remove Feature or Program

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1028 Operating System Configuration M1038 Execution Prevention

Detection Coverage

12 strategies

5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0384 Behavioral Detection of Unix Shell Execu...

Installation (4)

DET0034 Detection of Adversarial Process Discove... DET0126 Detection Strategy for SSH Key Injection... DET0370 Recursive Enumeration of Files and Direc... DET0525 System Discovery via Native and Remote U...

Command & Control (3)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (1)

DET0435 Detection Strategy for Hijack Execution...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

titan

Type: Criminal Sophistication: Medium First seen: 2026 Active

tracked as Charming Kitten ESET said Newscaster Parastoo +16 more

Infrastructure 38 IOC(s)

50%

Domain

27.Lorenz ip-api.com 23.Lebonnois 24.Vinatier 25.Lunine +30

IPv4 Address

3.39.22.13 35.74.215.126 13.236.179.8

Artifacts (2)

audit@patchstack.com titan.tar.gz

Capability

53%

12 technique(s) 56 tool(s)/malware 6 CVE(s)

ALFA TEaM Shell Anubis Atmosphere Aurora Check Point Security Gateway ConnectWise ConnectWise ScreenConnect Conti +48

command and control

T1071 T1071.001 T1105

discovery

T1057 T1082 T1083

execution

T1059.004 T1203

initial access

T1190 T1566.001

Victim

70%

Targeted Sectors

government defense financial-services healthcare media transportation construction food-agriculture critical-infrastructure manufacturing telecommunications non-profit

Targeted Countries

UA US AE RU IL CN DE BR GB IR FR JP PL NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

Resources

government

First Seen

2026-04-14

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

ALFA TEaM Shell Anubis Atmosphere

Infrastructure

27.Lorenz ip-api.com 23.Lebonnois

4 Exploitation

Capability (Techniques)

T1059.004 T1203

Capability (Malware)

ALFA TEaM Shell Anubis Atmosphere

Infrastructure

27.Lorenz ip-api.com 23.Lebonnois

5 Installation

Capability (Techniques)

T1057 T1082 T1083 T1098.004

Capability (Malware)

ALFA TEaM Shell Anubis Atmosphere

Infrastructure

27.Lorenz ip-api.com 23.Lebonnois

6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1105

Capability (Malware)

ALFA TEaM Shell Anubis Atmosphere

Infrastructure

27.Lorenz ip-api.com 23.Lebonnois