Incident Score: Analysis & Impact (VEEFORCIT1781857680)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Attachment (T1566.001) with moderate to high confidence (80%), supported by evidence indicating initial access is often gained through spear-phishing, Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating compromised credentials from access brokers, and Exploit Public-Facing Application (T1190) with high confidence (95%), supported by evidence indicating exploitation of known vulnerabilities in public-facing systems (CVE-2023-3519, CVE-2023-48788, CVE-2025-5777). Under the Execution tactic, the analysis identified Command and Scripting Interpreter: PowerShell (T1059.001) with high confidence (90%), supported by evidence indicating deploying a customized PowerShell script that extracts credentials from Veeam backup servers and Command and Scripting Interpreter: Windows Command Shell (T1059.003) with moderate to high confidence (70%), supported by evidence indicating attackers use command-line tools and IP scanners to map the network. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating compromised credentials from access brokers. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating compromised credentials from access brokers. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate to high confidence (80%), supported by evidence indicating ransomware payloads rewritten in Rust for cross-platform attacks, Execution Guardrails: Environmental Keying (T1480.001) with moderate confidence (60%), supported by evidence indicating malware avoids critical system files to ensure ransom notes are visible, and Masquerading (T1036) with moderate to high confidence (70%), supported by evidence indicating use of LOLBins and RMM tools for network intrusion. Under the Credential Access tactic, the analysis identified Credentials from Password Stores (T1555) with high confidence (90%), supported by evidence indicating powerShell script extracts credentials from Veeam backup servers via salted DPAPI decryption and OS Credential Dumping (T1003) with moderate to high confidence (80%), supported by evidence indicating credentials extracted from Veeam backup servers. Under the Discovery tactic, the analysis identified Network Service Discovery (T1046) with moderate to high confidence (80%), supported by evidence indicating attackers use IP scanners to map the network and Account Discovery (T1087) with moderate to high confidence (70%), supported by evidence indicating network mapping and credential extraction imply account discovery. Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with moderate to high confidence (70%), supported by evidence indicating use of compromised credentials and network mapping for lateral movement and Remote Services: SMB/Windows Admin Shares (T1021.002) with moderate to high confidence (70%), supported by evidence indicating implied by network intrusion and credential abuse. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating backup data, virtual machines, and sensitive files compromised. Under the Command and Control tactic, the analysis identified Ingress Tool Transfer (T1105) with moderate to high confidence (70%), supported by evidence indicating use of RMM tools and rclone for network intrusion and data exfiltration. Under the Exfiltration tactic, the analysis identified Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with high confidence (90%), supported by evidence indicating rclone used for data exfiltration (double-extortion tactic) and Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating private portal for negotiations and public leak site. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (95%), supported by evidence indicating curve25519 ECC and AES-128 encryption, cross-platform ransomware payloads, Inhibit System Recovery (T1490) with high confidence (90%), supported by evidence indicating shuts down virtual machines before encrypting them, extracts credentials from Veeam backup servers, and Service Stop (T1489) with moderate to high confidence (80%), supported by evidence indicating shuts down virtual machines to maximize disruption. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.