Incident Score: Analysis & Impact (IMTEXOCOIMET1791462497)
The details regarding individual company incidents & reports gives you full view from every side.
Rankiteo Score Impact Analysis
Key Highlights From The Incident Analysis
- Timeline of Coinbase's Cyber Attack and lateral movement inside company's environment.
- Overview of affected data sets, including SSNs and PHI, and why they materially increase incident severity.
- How Rankiteo’s incident engine converts technical details into a normalized incident score.
- How this cyber incident impacts Coinbase Rankiteo cyber scoring and cyber rating.
- Rankiteo’s MITRE ATT&CK correlation analysis for this incident, with associated confidence level.
Full Incident Analysis Transcript
In this Rankiteo incident briefing, we review the Coinbase breach identified under incident ID IMTEXOCOIMET1791462497.
The analysis begins with a detailed overview of Coinbase's information like the linkedin page: https://www.linkedin.com/company/coinbase, the number of followers: 1432639, the industry type: Financial Services and the number of employees: 7370 employees
After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 100 and after the incident was 100 with a difference of 0 which is could be a good indicator of the severity and impact of the incident.
In the next step of the video, we will analyze in more details the incident and the impact it had on Coinbase and their customers.
On 15 September 2023, a cybersecurity incident called "DarkSword/Coruna Exploitation Platform Exposed in Server Leak" came to light.
Researchers at Censys uncovered an active DarkSword/Coruna exploitation-as-a-service platform targeting iPhones to harvest cryptocurrency wallet secrets.
The disruption is felt across the environment, affecting iPhones (iOS 16.1, 16.3.1, 18.4–18.7), and exposing Cryptocurrency wallet recovery phrases, device loot directories, control-plane accounts, with nearly 11 recovery phrases, 179 device loot directories, 75 control-plane accounts records at risk.
Formal response steps have not been shared publicly yet.
The case underscores how Ongoing (researchers uncovered infrastructure; no active zero-day exploitation confirmed), teams are taking away lessons such as The incident highlights the growing threat of modular, reseller-based exploitation-as-a-service platforms targeting mobile devices, particularly for cryptocurrency theft. Shared infrastructure and automated harvesting increase the scale and efficiency of such attacks, and recommending next steps like Enhance monitoring for watering-hole attacks and suspicious device polling behavior, Implement stricter validation for wallet recovery phrases and sensitive data storage and Disable TLS validation bypasses in enterprise and personal devices.
Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.
The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.
MITRE ATT&CK® Correlation Analysis
Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Drive-by Compromise (T1189) with high confidence (90%), with evidence including watering-hole beacon (166.88.95.90), and iPhones polling beacon every three seconds. Under the Execution tactic, the analysis identified Serverless Execution (T1648) with moderate to high confidence (70%), with evidence including exploit_server.py (FastAPI-based admin panel), and automates exploit distribution and Reflective Code Loading (T1620) with moderate to high confidence (80%), supported by evidence indicating bootstrap.dylib, stage2.dylib, core_v6.dylib implants. Under the Persistence tactic, the analysis identified Create or Modify System Process: Launch Agent (T1543.001) with moderate to high confidence (70%), supported by evidence indicating springBoard coordinator injecting theft modules. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1404) with moderate to high confidence (80%), supported by evidence indicating six-vulnerability chain targeting iOS 18.4–18.7. Under the Defense Evasion tactic, the analysis identified Subvert Trust Controls: Install Root Certificate (T1553.004) with moderate confidence (60%), supported by evidence indicating disabled TLS validation in infrastructure and Obfuscated Files or Information (T1027) with moderate to high confidence (70%), supported by evidence indicating 347 unique Mach-O binaries in recovered samples. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (90%), supported by evidence indicating bIP39 recovery phrase extraction from photos/Notes/wallet apps. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating 18 wallet-targeting modules for MetaMask, Coinbase, etc. and Screen Capture (T1113) with moderate to high confidence (70%), supported by evidence indicating bIP39 recovery phrase extraction from photos. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating 11 victim recovery phrases, 179 device loot directories exfiltrated. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (80%), supported by evidence indicating fastAPI-based admin panel (exploit_server.py) and Dynamic Resolution: Domain Generation Algorithms (T1568.002) with moderate to high confidence (70%), supported by evidence indicating domain-generation fallbacks in infrastructure. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.
Sources & References
- Coinbase Rankiteo Cyber Incident Details: https://www.rankiteo.com/company/coinbase/incident/IMTEXOCOIMET1791462497
- Coinbase CyberSecurity Rating page: https://www.rankiteo.com/company/coinbase
- Coinbase Rankiteo Cyber Incident Blog Article: https://blog.rankiteo.com/imtexocoimet1791462497-metamask-coinbase-exodus-imtoken-cyber-attack-september-2026/
- Coinbase CyberSecurity Score History: https://www.rankiteo.com/company/coinbase/history
- Coinbase CyberSecurity Incident Source: https://gbhackers.com/exposed-darksword-ios-servers/
- Rankiteo A.I CyberSecurity Rating methodology: https://www.rankiteo.com/Images/rankiteo_algo.pdf
- Rankiteo TPRM Scoring methodology: https://static.rankiteo.com/model/rankiteo_tprm_methodology.pdf