Incident Score: Analysis & Impact (INOCEN1775802306)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), with evidence including outdated web forms lacking modern security protocols, and sQL injection, cross-site scripting (XSS), session hijacking, Drive-by Compromise (T1189) with moderate to high confidence (70%), supported by evidence indicating legacy web forms used for clinical trial recruitment, adverse event reporting, and Phishing: Spearphishing Link (T1566.002) with moderate confidence (60%), supported by evidence indicating third-party breaches accounting for 30% of incidents. Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with moderate to high confidence (80%), supported by evidence indicating sQL injection, cross-site scripting (XSS) as attack vectors. Under the Persistence tactic, the analysis identified External Remote Services (T1133) with moderate to high confidence (70%), supported by evidence indicating third-party vendor platforms as attack surface. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate to high confidence (70%), supported by evidence indicating weak authentication in legacy web forms. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating weak authentication leaving systems vulnerable and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating lack of tamper-proof audit trails. Under the Credential Access tactic, the analysis identified Brute Force: Password Guessing (T1110.001) with moderate to high confidence (70%), supported by evidence indicating weak authentication in legacy systems and Adversary-in-the-Middle (T1557) with moderate to high confidence (80%), supported by evidence indicating unencrypted data transmission exposing sensitive information. Under the Discovery tactic, the analysis identified Account Discovery: Domain Account (T1087.002) with moderate confidence (60%), supported by evidence indicating clinical trial data, adverse event reports compromised. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), with evidence including 170 GB of sensitive data compromised (Inotiv), and clinical trial data worth hundreds of millions and Data from Information Repositories: Sharepoint (T1213.002) with moderate to high confidence (70%), supported by evidence indicating regulatory submission data compromised via legacy web forms. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating 170 GB of sensitive data exfiltrated (Inotiv) and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating third-party vendor platforms as attack surface. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), with evidence including ransomware attack encrypted systems (Inotiv), and partial IT encryption (AEP), Defacement: Internal Defacement (T1491.001) with moderate confidence (60%), supported by evidence indicating disrupted operations, medicine delivery threats, and Data Manipulation: Stored Data Manipulation (T1565.001) with moderate to high confidence (70%), supported by evidence indicating lack of tamper-proof audit trails violating ALCOA+ principles. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.