Incident Score: Analysis & Impact (SCHBRI1773995566)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts: Local Accounts (T1078.003) with high confidence (90%), supported by evidence indicating exploited his access as a former contractor to steal sensitive data. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating retained access to sensitive data after contract termination. Under the Privilege Escalation tactic, the analysis identified Valid Accounts: Local Accounts (T1078.003) with moderate to high confidence (70%), supported by evidence indicating access to corporate and payroll data as a data analyst contractor. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with moderate confidence (60%), supported by evidence indicating stole sensitive documents including employee PII and compensation details. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating stole sensitive corporate and payroll data between August and December 2023 and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating accessed corporate and payroll data as a data analyst. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), supported by evidence indicating sent over 60 extortion emails with screenshots of employee PII and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating threatened to publicly release salary information. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with lower confidence (30%), supported by evidence indicating extortion scheme demanding $2.5 million to prevent data leak and Financial Theft (T1657) with high confidence (90%), supported by evidence indicating demanded $2.5 million ransom; received $7,540 in Bitcoin. Under the Defense Evasion tactic, the analysis identified Valid Accounts: Local Accounts (T1078.003) with moderate to high confidence (80%), supported by evidence indicating exploited legitimate access as a former contractor. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.