Incident Score: Analysis & Impact (9111778077940)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (60%), with evidence including targeted over 54 organizations worldwide, and disruption of critical infrastructure and Valid Accounts (T1078) with moderate confidence (50%), supported by evidence indicating former Russian law enforcement recruited to access government databases. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating multiple ransomware strains (Akira, Royal, Karakurt, TommyLeaks, SchoolBoys). Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating former Conti members operated with corporate-like structure. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating access to government databases via former law enforcement. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with high confidence (90%), supported by evidence indicating used multiple ransomware strains to obscure their activities and evade detection and System Information Discovery (T1082) with moderate to high confidence (70%), supported by evidence indicating identifying the most damaging information to pressure victims. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with moderate confidence (50%), supported by evidence indicating stolen data leveraged for extortion, including sensitive records. Under the Discovery tactic, the analysis identified System Information Discovery (T1082) with moderate to high confidence (80%), supported by evidence indicating identifying the most damaging information to pressure victims and File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating distributing sensitive records such as children’s medical files. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating data exfiltration confirmed, including medical records and sensitive personal information. Under the Command and Control tactic, the analysis identified Proxy (T1090) with moderate confidence (60%), supported by evidence indicating operated from St. Petersburg, Russia, with international targets. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration confirmed, including children’s medical files. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating ransomware strains used for data encryption (Akira, Royal, Karakurt), Defacement: Internal Defacement (T1491.001) with moderate to high confidence (70%), supported by evidence indicating psychological extortion tactics to coerce victims into paying ransoms, and Service Stop (T1489) with moderate to high confidence (80%), supported by evidence indicating disruption of critical infrastructure, including 911 emergency response system. Under the Financial Theft tactic, the analysis identified Ransomware (T1657) with high confidence (100%), supported by evidence indicating $69 million paid by victims, financial losses exceeded $56 million. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.