Incident Score: Analysis & Impact (ANA1775660330)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), with evidence including exploiting vulnerable SOHO routers, and insecure edge devices to reroute DNS traffic and External Remote Services (T1133) with moderate to high confidence (80%), with evidence including gained control of SOHO routers, and targeting vulnerable small office/home office (SOHO) routers. Under the Persistence tactic, the analysis identified Account Manipulation (T1098) with moderate to high confidence (70%), supported by evidence indicating altering their DNS settings to redirect queries to malicious servers. Under the Defense Evasion tactic, the analysis identified Impair Defenses: Disable or Modify Tools (T1562.001) with moderate to high confidence (80%), with evidence including altering their DNS settings, and dNS hijacking via dnsmasq utility and Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating using legitimate dnsmasq utility. Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle (T1557) with high confidence (90%), with evidence including aiTM attacks against TLS connections, and intercepting plaintext traffic including emails and Adversary-in-the-Middle: TLS Interception (T1557.002) with high confidence (90%), supported by evidence indicating spoofed DNS responses to force connections to attacker-controlled infrastructure. Under the Collection tactic, the analysis identified Data Staged (T1074) with moderate to high confidence (80%), with evidence including monitoring traffic for intelligence collection, and intercepting cloud-hosted content, Email Collection (T1114) with high confidence (90%), with evidence including intercepting plaintext traffic including emails, and microsoft Outlook on the web domains, and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating cloud-hosted content from sectors such as government, IT, telecommunications. Under the Command and Control tactic, the analysis identified Application Layer Protocol: DNS (T1071.004) with high confidence (90%), supported by evidence indicating dNS hijacking to reroute DNS traffic through actor-controlled resolvers and Dynamic Resolution (T1568) with moderate to high confidence (70%), supported by evidence indicating actor-controlled resolvers for DNS requests. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), with evidence including large-scale surveillance, and intelligence-gathering in support of Russian foreign policy. Under the Reconnaissance tactic, the analysis identified Gather Victim Network Information (T1590) with high confidence (90%), with evidence including passive reconnaissance, and monitoring traffic for intelligence collection and Gather Victim Network Information: Domain Properties (T1590.001) with moderate to high confidence (80%), supported by evidence indicating dNS hijacking to resolve DNS requests. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.