Incident Score: Analysis & Impact (AUDCHA1782073550)
The details regarding individual company incidents & reports gives you full view from every side.
Rankiteo Score Impact Analysis
Key Highlights From The Incident Analysis
- Timeline of Chainalysis's Cyber Attack and lateral movement inside company's environment.
- Overview of affected data sets, including SSNs and PHI, and why they materially increase incident severity.
- How Rankiteo’s incident engine converts technical details into a normalized incident score.
- How this cyber incident impacts Chainalysis Rankiteo cyber scoring and cyber rating.
- Rankiteo’s MITRE ATT&CK correlation analysis for this incident, with associated confidence level.
Full Incident Analysis Transcript
In this Rankiteo incident briefing, we review the Chainalysis breach identified under incident ID AUDCHA1782073550.
The analysis begins with a detailed overview of Chainalysis's information like the linkedin page: https://www.linkedin.com/company/chainalysis, the number of followers: 178802, the industry type: Software Development and the number of employees: 795 employees
After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 100 and after the incident was 100 with a difference of 0 which is could be a good indicator of the severity and impact of the incident.
In the next step of the video, we will analyze in more details the incident and the impact it had on Chainalysis and their customers.
AudiA6 recently reported "Global Authorities Dismantle $380M Ransomware Crypto-Laundering Network AudiA6", a noteworthy cybersecurity incident.
In a coordinated crackdown, law enforcement agencies from 11 countries dismantled AudiA6, a sophisticated cryptocurrency mixing service that laundered over $380 million in ransomware and cybercrime proceeds between 2022 and 2025.
The disruption is felt across the environment, with nearly 6,000 fraudulent exchange accounts records at risk, plus an estimated financial loss of $380 million laundered.
In response, moved swiftly to contain the threat with measures like Seizure of 25 domains, 80 vehicles and properties, 692,000 euros in frozen cryptocurrency, 86,000 euros in cash; blocking of Telegram accounts.
The case underscores how Ongoing (disruption achieved, but similar operations may remain active), teams are taking away lessons such as Ransomware payments depend on industrialized identity theft to move funds into legitimate financial systems. Cryptocurrency mixers rely on fraudulent KYC processes to operate at scale.
Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.
The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.
MITRE ATT&CK® Correlation Analysis
Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Compromise Accounts (T1586) with high confidence (90%), supported by evidence indicating 6,000 fraudulent exchange accounts, each created using stolen or purchased identities and Establish Accounts: Social Media Accounts (T1585.001) with moderate to high confidence (70%), supported by evidence indicating fraudulent exchange accounts provided KYC cover to process withdrawals. Under the Resource Development tactic, the analysis identified Obtain Capabilities: Tool (T1588.002) with moderate to high confidence (80%), supported by evidence indicating audiA6 functioned as a professional crypto-mixer for laundering, Acquire Infrastructure: Web Services (T1583.006) with moderate to high confidence (80%), supported by evidence indicating 25 domains seized, Telegram accounts blocked as communication channels, and Compromise Accounts: Cloud Accounts (T1586.002) with high confidence (90%), supported by evidence indicating 6,000 fraudulent exchange accounts used for KYC cover. Under the Defense Evasion tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with high confidence (90%), supported by evidence indicating fraudulent exchange accounts provided KYC cover for withdrawals, Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate to high confidence (70%), supported by evidence indicating funds pre-layered through smaller exchanges and privacy coins, and Obfuscated Files or Information (T1027) with moderate to high confidence (80%), supported by evidence indicating complex transaction routes to obscure origins of tainted funds. Under the Credential Access tactic, the analysis identified Gather Victim Identity Information: Email Addresses (T1589.002) with moderate to high confidence (80%), supported by evidence indicating stolen or purchased identities sourced through Russian-speaking networks and Gather Victim Identity Information: Credentials (T1589.001) with high confidence (90%), supported by evidence indicating 6,000 fraudulent exchange accounts created using stolen identities. Under the Collection tactic, the analysis identified Data from Information Repositories: Sharepoint (T1213.002) with moderate confidence (60%), supported by evidence indicating stolen identities likely collected from compromised repositories and Data from Local System (T1005) with moderate to high confidence (70%), supported by evidence indicating forensic analysis of suspect’s devices led to key operators. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (70%), supported by evidence indicating telegram accounts used as communication channels for the network. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating $380 million laundered through complex transaction routes and Automated Exfiltration (T1020) with moderate to high confidence (70%), supported by evidence indicating funds returned to criminals within an hour via automated mixing. Under the Impact tactic, the analysis identified Data Destruction (T1485) with moderate confidence (50%), supported by evidence indicating seizure of 25 domains and disruption of laundering operations and Defacement: Internal Defacement (T1491.001) with moderate confidence (60%), supported by evidence indicating blocking of Telegram accounts disrupted communication channels. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.
Sources & References
- Chainalysis Rankiteo Cyber Incident Details: https://www.rankiteo.com/company/chainalysis/incident/AUDCHA1782073550
- Chainalysis CyberSecurity Rating page: https://www.rankiteo.com/company/chainalysis
- Chainalysis Rankiteo Cyber Incident Blog Article: https://blog.rankiteo.com/audcha1782073550-dark2web-audia6-cyber-attack-september-2025/
- Chainalysis CyberSecurity Score History: https://www.rankiteo.com/company/chainalysis/history
- Chainalysis CyberSecurity Incident Source: https://www.cybersecurity-insiders.com/audia6-ransomware-crypto-laundering-dismantled/
- Rankiteo A.I CyberSecurity Rating methodology: https://www.rankiteo.com/Images/rankiteo_algo.pdf
- Rankiteo TPRM Scoring methodology: https://static.rankiteo.com/model/rankiteo_tprm_methodology.pdf