Incident Score: Analysis & Impact (DOMDBS1770325487)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise (T1195) with high confidence (90%), supported by evidence indicating ransomware attack on a printing vendor exposed sensitive customer data and Compromise Software Supply Chain (T1195.002) with moderate to high confidence (80%), supported by evidence indicating third-party vendor (printing vendor) as attack vector. Under the Reconnaissance tactic, the analysis identified Active Scanning (T1595) with moderate to high confidence (70%), supported by evidence indicating attacks begin with weeks or months of reconnaissance and Gather Victim Org Information (T1591) with moderate to high confidence (80%), supported by evidence indicating high-value targets such as Banks (DBS, Bank of China). Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle (T1557) with moderate confidence (50%), supported by evidence indicating neither bank reported compromised login credentials (implies possible attempt). Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating stolen data including names, addresses, loan account numbers and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating data breach impacting 8,200 DBS customers and 3,000 BOC customers. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), with evidence including data exfiltration such as Yes, and ransomware groups prioritize data theft over encryption and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating double-extortion (threatening data leaks). Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate to high confidence (70%), with evidence including type such as Ransomware, and malware that encrypts or locks data until a ransom is paid, Defacement (T1491) with lower confidence (40%), supported by evidence indicating brand reputation impact such as High, and Data Destruction (T1485) with moderate confidence (50%), supported by evidence indicating some variants, like wipers, destroy data even after payment. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating reconnaissance period such as Weeks or months (implies stealth) and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (50%), supported by evidence indicating aI-powered ransomware adapting during attacks. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.