Incident Score: Analysis & Impact (SMASIMCONAMADAT1775551328)
The details regarding individual company incidents & reports gives you full view from every side.
Rankiteo Score Impact Analysis
Key Highlights From The Incident Analysis
- Timeline of Amazon's Cyber Attack and lateral movement inside company's environment.
- Overview of affected data sets, including SSNs and PHI, and why they materially increase incident severity.
- How Rankiteo’s incident engine converts technical details into a normalized incident score.
- How this cyber incident impacts Amazon Rankiteo cyber scoring and cyber rating.
- Rankiteo’s MITRE ATT&CK correlation analysis for this incident, with associated confidence level.
Full Incident Analysis Transcript
In this Rankiteo incident briefing, we review the Amazon breach identified under incident ID SMASIMCONAMADAT1775551328.
The analysis begins with a detailed overview of Amazon's information like the linkedin page: https://www.linkedin.com/company/amazon, the number of followers: 35933128, the industry type: Software Development and the number of employees: 772896 employees
After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 808 and after the incident was 803 with a difference of -5 which is could be a good indicator of the severity and impact of the incident.
In the next step of the video, we will analyze in more details the incident and the impact it had on Amazon and their customers.
On 10 February 2026, a cybersecurity incident called "Microsoft Warns of Tax-Season Phishing Surge Targeting U.S. Organizations" came to light.
Microsoft has identified a wave of phishing campaigns exploiting the U.S.
The disruption is felt across the environment, affecting Microsoft 365 Accounts and RMM Tools (ScreenConnect, Datto, SimpleHelp), and exposing Credentials (including 2FA codes), Sensitive Financial Data, Corporate Access.
Formal response steps have not been shared publicly yet.
The case underscores how Ongoing, teams are taking away lessons such as Tax-season phishing campaigns are highly effective due to urgency and trust in tax-related communications. Abuse of trusted RMM tools complicates detection and attribution. Organizations must enhance monitoring for unauthorized RMM usage and educate employees on phishing risks during high-risk periods, and recommending next steps like Implement multi-factor authentication (MFA) with phishing-resistant methods (e.g., FIDO2), Monitor for unauthorized or unusual RMM tool usage and Conduct regular phishing awareness training, especially during tax season.
Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.
The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.
MITRE ATT&CK® Correlation Analysis
Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Attachment (T1566.001) with high confidence (90%), supported by evidence indicating fake refund notices, payroll forms, and IRS impersonations to trick recipients into interacting with malicious links, QR codes, or attachments, Phishing: Spearphishing Link (T1566.002) with high confidence (90%), supported by evidence indicating malicious links, QR codes...redirecting victims to fake Microsoft 365 sign-in pages, and Phishing: Spearphishing via Service (T1566.003) with moderate to high confidence (80%), supported by evidence indicating emails sent via Amazon SES claimed irregular tax returns under recipients’ Electronic Filing Identification Numbers (EFINs). Under the Execution tactic, the analysis identified User Execution: Malicious Link (T1204.001) with high confidence (90%), supported by evidence indicating trick recipients into interacting with malicious links, QR codes, or attachments and User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating fake SmartVault site (*smartvault.im*) to download a malicious ScreenConnect installer. Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle: Rogue Wi-Fi Network (T1557.003) with moderate confidence (60%), supported by evidence indicating phishing-as-a-Service (PhaaS) platforms...harvest credentials, including two-factor authentication (2FA) codes, Input Capture: Keylogging (T1056.001) with moderate to high confidence (70%), supported by evidence indicating spoofed Microsoft 365 login pages to harvest credentials, and Modify Authentication Process: Multi-Factor Authentication (T1556.006) with moderate to high confidence (80%), supported by evidence indicating harvest credentials, including two-factor authentication (2FA) codes. Under the Persistence tactic, the analysis identified External Remote Services (T1133) with high confidence (90%), supported by evidence indicating deploy remote monitoring and management (RMM) tools such as ConnectWise ScreenConnect, Datto, and SimpleHelp to gain persistent access and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (80%), supported by evidence indicating compromised Microsoft 365 accounts used for persistent access. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), supported by evidence indicating fake SmartVault site (*smartvault.im*), domains like *irs-doc.com*, Subvert Trust Controls: Code Signing (T1553.002) with moderate confidence (60%), supported by evidence indicating rMM tools...trusted in corporate environments, unauthorized usage can go unnoticed, and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (80%), supported by evidence indicating abuse of compromised Microsoft 365 accounts to evade detection. Under the Command and Control tactic, the analysis identified Remote Access Software (T1219) with high confidence (90%), supported by evidence indicating deploy remote monitoring and management (RMM) tools such as ConnectWise ScreenConnect, Datto, and SimpleHelp and Ingress Tool Transfer (T1105) with moderate to high confidence (80%), supported by evidence indicating malicious ScreenConnect installer downloaded from fake SmartVault site. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), supported by evidence indicating potential data exfiltration via RMM tools (ScreenConnect, Datto, SimpleHelp) and Transfer Data to Cloud Account (T1537) with moderate confidence (60%), supported by evidence indicating credentials and sensitive financial data harvested via spoofed Microsoft 365 login pages. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.
Sources & References
- Amazon Rankiteo Cyber Incident Details: https://www.rankiteo.com/company/amazon/incident/SMASIMCONAMADAT1775551328
- Amazon CyberSecurity Rating page: https://www.rankiteo.com/company/amazon
- Amazon Rankiteo Cyber Incident Blog Article: https://blog.rankiteo.com/smasimconamadat1775551328-connectwise-datto-smartvault-simplehelp-amazon-cyber-attack-february-2026/
- Amazon CyberSecurity Score History: https://www.rankiteo.com/company/amazon/history
- Amazon CyberSecurity Incident Source: https://thehackernews.com/2026/03/microsoft-warns-irs-phishing-hits-29000.html
- Rankiteo A.I CyberSecurity Rating methodology: https://www.rankiteo.com/Images/rankiteo_algo.pdf
- Rankiteo TPRM Scoring methodology: https://static.rankiteo.com/model/rankiteo_tprm_methodology.pdf