Incident Score: Analysis & Impact (CON1766104576)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with moderate to high confidence (70%), supported by evidence indicating likely phishing, malware, or exploit-based attack vector and Exploit Public-Facing Application (T1190) with moderate confidence (50%), supported by evidence indicating unknown attack vector, but historically linked to exploits. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating trickbot malware operations targeting thousands of victims and Command and Scripting Interpreter (T1059) with moderate confidence (60%), supported by evidence indicating malware-based attacks (e.g., Qakbot investigation link). Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating six-year hacking campaign implies persistent access and Create or Modify System Process (T1543) with moderate confidence (60%), supported by evidence indicating trickbot/Conti malware infrastructure. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate confidence (60%), supported by evidence indicating targeting of high-value entities (hospitals, businesses). Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate to high confidence (80%), supported by evidence indicating trickbots six-year evasion of attribution and Hide Artifacts: Hidden Window (T1564.003) with moderate confidence (60%), supported by evidence indicating malware operations with stealth capabilities. Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with moderate to high confidence (70%), supported by evidence indicating data theft including payment information and PII and Credentials from Password Stores (T1555) with moderate confidence (60%), supported by evidence indicating targeting of sensitive organizational data. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (70%), supported by evidence indicating targeted attacks on 428 U.S. hospitals and File and Directory Discovery (T1083) with moderate confidence (60%), supported by evidence indicating data exfiltration and theft of sensitive files. Under the Lateral Movement tactic, the analysis identified Remote Services (T1021) with moderate to high confidence (70%), supported by evidence indicating global hacking campaign across industries. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating data theft including PII and payment information and Automated Collection (T1119) with moderate to high confidence (70%), supported by evidence indicating hundreds of millions stolen over six years. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration confirmed in ransomware details and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating cybercrime cartel operations with global reach. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate to high confidence (80%), supported by evidence indicating ransomware operations linked to Trickbot/Conti and Service Stop (T1489) with moderate to high confidence (70%), supported by evidence indicating disruption to healthcare services and businesses. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.