Incident Score: Analysis & Impact (ADD3230332112425)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), with evidence including high value targets such as User PII, Authentication Credentials, and exploited weak MD5-hashed passwords for credential access and Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), supported by evidence indicating root causes such as Potential lack of intrusion detection/monitoring, Possible misconfiguration in database security. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (95%), with evidence including mD5-hashed passwords in leaked database dump, and sensitivity of data such as High (PII + weak password hashes) and Brute Force: Password Guessing (T1110.001) with moderate to high confidence (85%), with evidence including identity theft risk such as High (Exposed PII enables phishing/credential stuffing), and mD5 hashes are crackable with modern tools. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), with evidence including database dump (likely CSV/JSON) containing 1.86M records, and data exfiltration such as true. Under the Exfiltration tactic, the analysis identified Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (T1048.003) with moderate to high confidence (80%), with evidence including data exfiltration such as true, and data leaked on underground cybercrime forums (145 MB uncompressed). Under the Impact tactic, the analysis identified Phishing for Information: Spearphishing via Service (T1598.003) with high confidence (90%), with evidence including identity theft risk such as High (Exposed PII enables phishing/credential stuffing), and personally identifiable information such as Full Names, Phone Numbers, Email Addresses and Malicious Account Use (T1659) with moderate to high confidence (75%), with evidence including data sold on dark web such as true, and threat actor motivation such as Financial Gain (Data Sale). Under the Defense Evasion tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (70%), with evidence including adda.io is a community and housing society management platform (SaaS), and no MFA mentioned; weak hashing suggests account takeover risk. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.