Incident Score: Analysis & Impact (AMACLONPM1786444537)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with high confidence (90%), with evidence including malicious VS Code Extensions disguised as Solidity Pro, and npm package `ascii-fetcher` with malicious dependency and User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating developers installed malicious VS Code extensions and npm packages. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: JavaScript (T1059.007) with moderate to high confidence (80%), supported by evidence indicating extensions executed JavaScript payloads, HTA droppers, Command and Scripting Interpreter: Windows Command Shell (T1059.003) with moderate to high confidence (70%), supported by evidence indicating npm package used `child_process.exec` with `windowsHide` for silent execution, and Container Administration Command (T1609) with moderate confidence (60%), supported by evidence indicating extensions targeted VS Code forks (Cursor, Windsurf, Codium, Positron). Under the Persistence tactic, the analysis identified Browser Extensions (T1176) with high confidence (90%), supported by evidence indicating malicious VS Code extensions installed and persisted on developer machines and Compromise Client Software Binary (T1554) with moderate to high confidence (80%), supported by evidence indicating extensions disguised as legitimate Solidity Pro tools. Under the Privilege Escalation tactic, the analysis identified Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002) with moderate confidence (50%), supported by evidence indicating extensions may have leveraged developer privileges for credential access. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with high confidence (90%), supported by evidence indicating heavy obfuscation, splitting strings across IIFEs, reassembling at runtime, Virtualization/Sandbox Evasion: Time Based Evasion (T1497.003) with moderate to high confidence (80%), supported by evidence indicating delayed activation hours/days after installation to evade sandboxing, and Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), supported by evidence indicating extensions disguised as Solidity Pro, clean intermediate versions published. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (90%), supported by evidence indicating harvested GitHub tokens, AWS keys, Cloudflare tokens, SSH keys, wallet seeds, Unsecured Credentials: Private Keys (T1552.004) with high confidence (90%), supported by evidence indicating sSH private keys, Bitcoin WIF/xprv keys, wallet vaults (MetaMask, Phantom), Credentials from Password Stores: Credentials from Web Browsers (T1555.003) with moderate to high confidence (70%), supported by evidence indicating uRL credentials and 1Password MFA tokens stolen, and Multi-Factor Authentication Interception (T1111) with moderate confidence (60%), supported by evidence indicating 1Password MFA tokens harvested. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating collected source control tokens, cloud credentials, wallet data, SSH keys and Clipboard Data (T1115) with moderate to high confidence (80%), supported by evidence indicating clipboard stealer swapped cryptocurrency addresses via `vscode.env.clipboard.writeText`. Under the Command and Control tactic, the analysis identified Web Service: Bidirectional Communication (T1102.002) with moderate to high confidence (80%), supported by evidence indicating exfiltrated data via Telegram bot, fetched payloads from Cloudflare Workers and Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (70%), supported by evidence indicating used Cloudflare Workers for encrypted Python payload delivery. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating stolen data exfiltrated via Telegram bot and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating potential use of Cloudflare Workers for data staging. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (70%), supported by evidence indicating cryptocurrency address swapping via clipboard stealer and Account Access Removal (T1531) with moderate confidence (50%), supported by evidence indicating potential unauthorized access to repositories/cloud infrastructure. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.