Incident Score: Analysis & Impact (CHE1781929626)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (50%), with evidence including unauthorized access to its network, and days-long network outage suspected to be ransomware and Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating unauthorized actor accessed and exfiltrated sensitive data. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), with evidence including ransomware attack, and days-long network outage suspected to be ransomware. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (60%), with evidence including unauthorized access to its network, and data exfiltration confirmed. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating accessed and exfiltrated sensitive data including SSNs and health IDs. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate confidence (50%), with evidence including ransomware attack, and investigation supported by third-party specialists and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), with evidence including days-long network outage, and unauthorized access to network. Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with moderate to high confidence (70%), supported by evidence indicating social Security numbers, health insurance IDs compromised and Unsecured Credentials: Credentials In Files (T1552.001) with moderate confidence (60%), supported by evidence indicating personal and healthcare data exfiltrated. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate confidence (60%), supported by evidence indicating names, addresses, phone numbers, dates of birth compromised and File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating healthcare data including provider names and service dates exfiltrated. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating personal details and healthcare data compromised and Data from Information Repositories (T1213) with moderate to high confidence (70%), supported by evidence indicating health insurance IDs, patient ID numbers, provider names exfiltrated. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating unauthorized actor accessed and exfiltrated sensitive data and Transfer Data to Cloud Account (T1537) with moderate confidence (50%), supported by evidence indicating data breach affecting over 184,000 individuals. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate to high confidence (70%), with evidence including ransomware attack, and days-long network outage and Data Destruction (T1485) with lower confidence (40%), supported by evidence indicating network outage suspected to be ransomware. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.