Incident Score: Analysis & Impact (AXIGOO1775048584)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with high confidence (90%), with evidence including compromised a software developer’s account tied to Axios, and pushing malicious updates to organizations and Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating attackers gained control of the developer’s account for three hours. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating pushing malicious updates to organizations that downloaded the software. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating attackers gained control of the developer’s account for three hours. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating compromised a software developer’s account tied to Axios. Under the Defense Evasion tactic, the analysis identified Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with moderate to high confidence (80%), supported by evidence indicating pushing malicious updates to organizations via trusted software. Under the Credential Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating attackers gained control of the developer’s account. Under the Lateral Movement tactic, the analysis identified Use Alternate Authentication Material: Pass the Hash (T1550.002) with moderate confidence (50%), supported by evidence indicating compromised developer account used to push updates to downstream orgs. Under the Collection tactic, the analysis identified Data from Information Repositories (T1213) with moderate to high confidence (70%), supported by evidence indicating aimed at stealing cryptocurrency from cryptocurrency firms. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating north Korean hackers...stealing cryptocurrency to fund nuclear program. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (80%), supported by evidence indicating stealing cryptocurrency to fund North Korea’s nuclear and missile programs. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.