Incident Score: Analysis & Impact (SMASIMCONAMADAT1775551328)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (95%), with evidence including wave of phishing campaigns exploiting the U.S. tax season, and fake refund notices, payroll forms, and IRS impersonations, Phishing: Spearphishing Link (T1566.001) with high confidence (90%), with evidence including malicious links, QR codes, or attachments, and redirecting victims to fake Microsoft 365 sign-in pages, and Phishing: Spearphishing Attachment (T1566.002) with moderate to high confidence (80%), with evidence including malicious attachments, and fake tax-filing assistance links. Under the Execution tactic, the analysis identified User Execution: Malicious Link (T1204.001) with high confidence (90%), with evidence including trick recipients into interacting with malicious links, QR codes, and fake Microsoft 365 sign-in pages and User Execution: Malicious File (T1204.002) with moderate to high confidence (85%), with evidence including malicious attachments, and download a malicious ScreenConnect installer. Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle (T1557) with high confidence (90%), with evidence including spoofed Microsoft 365 login pages, and harvest credentials, including two-factor authentication (2FA) codes and Brute Force: Password Guessing (T1110.001) with moderate confidence (50%), supported by evidence indicating phishing-as-a-Service (PhaaS) platforms like Energy365 and SneakyLog. Under the Persistence tactic, the analysis identified External Remote Services (T1133) with high confidence (90%), supported by evidence indicating deploy remote monitoring and management (RMM) tools such as ConnectWise ScreenConnect, Datto, and SimpleHelp and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (85%), with evidence including compromised Microsoft 365 accounts, and credentials (including 2FA codes) harvested. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), with evidence including fake SmartVault site (smartvault.im), and iRS impersonation with domains like irs-doc.com and Subvert Trust Controls: Code Signing (T1553.002) with moderate to high confidence (70%), with evidence including abuse of trusted RMM tools to evade detection, and rMM software is often trusted in corporate environments. Under the Command and Control tactic, the analysis identified Remote Access Software (T1219) with high confidence (95%), supported by evidence indicating deploy RMM tools (ScreenConnect, Datto, SimpleHelp) to gain persistent access. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), with evidence including potential data exfiltration, and 29,000 users across 10,000 organizations affected. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.