Incident Score: Analysis & Impact (DAW1770631199)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), supported by evidence indicating exposed Docker APIs, Kubernetes clusters, Ray dashboards, Redis servers, External Remote Services (T1133) with moderate to high confidence (80%), supported by evidence indicating exploits misconfigurations and known vulnerabilities in cloud-native environments, and Exploitation of Remote Services (T1210) with high confidence (90%), supported by evidence indicating react2Shell vulnerability (CVE-2025-55182, CVSS 10.0). Under the Execution tactic, the analysis identified Command and Scripting Interpreter (T1059) with high confidence (90%), supported by evidence indicating scanner.py, kube.py, react.py, pcpcat.py automate exploitation and payload deployment, Container Administration Command (T1609) with moderate to high confidence (80%), supported by evidence indicating deploys malicious containers with Base64-encoded payloads via exposed Docker APIs, and Deploy Container (T1610) with moderate to high confidence (80%), supported by evidence indicating malicious containers deployed via pcpcat.py and proxy.sh. Under the Persistence tactic, the analysis identified Escape to Host (T1611) with moderate to high confidence (70%), supported by evidence indicating establishes persistent backdoors via privileged pods in Kubernetes and Server Software Component: Web Shell (T1505.003) with moderate confidence (60%), supported by evidence indicating proxy.sh performs environment fingerprinting and establishes backdoors. Under the Privilege Escalation tactic, the analysis identified Escape to Host (T1611) with moderate to high confidence (70%), supported by evidence indicating harvests Kubernetes cluster credentials and propagates across pods and Exploitation for Privilege Escalation (T1068) with moderate to high confidence (80%), supported by evidence indicating exploits React2Shell (CVE-2025-55182) for remote command execution. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate to high confidence (80%), supported by evidence indicating deploys Base64-encoded payloads via malicious containers and Hide Artifacts: Hidden Window (T1564.003) with moderate confidence (60%), supported by evidence indicating proxy.sh and scanner.py operate in background for infrastructure exploitation. Under the Credential Access tactic, the analysis identified Cloud Instance Metadata API (T1552.007) with moderate to high confidence (70%), supported by evidence indicating kube.py harvests Kubernetes cluster credentials. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (70%), supported by evidence indicating kube.py discovers Kubernetes resources and propagates across pods, Network Service Scanning (T1046) with high confidence (90%), supported by evidence indicating scanner.py scans for misconfigured Docker APIs and Ray dashboards, and Cloud Service Discovery (T1526) with moderate to high confidence (80%), supported by evidence indicating targets AWS and Microsoft Azure environments opportunistically. Under the Lateral Movement tactic, the analysis identified Lateral Tool Transfer (T1570) with moderate to high confidence (80%), supported by evidence indicating proxy.sh propagates across pods in Kubernetes clusters and Remote Services: Cloud Services (T1021.007) with moderate to high confidence (70%), supported by evidence indicating compromises cloud-native environments for follow-on exploitation. Under the Collection tactic, the analysis identified Data from Cloud Storage (T1530) with moderate to high confidence (80%), supported by evidence indicating cV databases, identity records, and corporate files compromised. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (80%), supported by evidence indicating c2 server (67.217.57.240) linked to Sliver open-source C2 framework and Ingress Tool Transfer (T1105) with moderate to high confidence (70%), supported by evidence indicating deploys proxy, P2P, and tunneling utilities via proxy.sh. Under the Exfiltration tactic, the analysis identified Transfer Data to Cloud Account (T1537) with moderate to high confidence (80%), supported by evidence indicating stolen data published via ShellForce for ransomware and fraud and Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), supported by evidence indicating data exfiltration via Sliver C2 framework. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with high confidence (90%), supported by evidence indicating cryptocurrency mining via mine.sh deployed by scanner.py, Data Encrypted for Impact (T1486) with moderate to high confidence (70%), supported by evidence indicating ransomware deployment as part of hybrid monetization model, and Defacement: External Defacement (T1491.002) with moderate confidence (60%), supported by evidence indicating stolen data published via ShellForce for extortion and reputation-building. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.