Incident Score: Analysis & Impact (ELEEXOLEDTRE1784199019)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), supported by evidence indicating fake Google API Connector update prompt to capture macOS password and Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (80%), supported by evidence indicating phishing pages disguised as legitimate wallet applications (Ledger Live, Trezor Suite). Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating malware designed to harvest credentials, wallet databases, and session data. Under the Credential Access tactic, the analysis identified Credentials from Password Stores (T1555) with high confidence (95%), supported by evidence indicating extracts sensitive information from Apple Keychain, Safari and Chromium browsers, Credentials from Password Stores: Keychain (T1555.001) with high confidence (90%), supported by evidence indicating targets Chrome Safe Storage secrets from Keychain to decrypt browser logins, and Unsecured Credentials: Credentials In Files (T1552.001) with moderate to high confidence (80%), supported by evidence indicating harvests wallet databases and potential unlocking material (passwords). Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (95%), supported by evidence indicating extracts wallet databases, Apple Notes, Telegram `tdata` directory, Automated Collection (T1119) with moderate to high confidence (80%), supported by evidence indicating malware casts a wide net, extracting data from multiple applications, and Data from Information Repositories (T1213) with moderate to high confidence (70%), supported by evidence indicating targets Safari and Chromium browsers for stored data. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating pairs stolen wallet databases with Keychain secrets for offline decryption. Under the Defense Evasion tactic, the analysis identified Masquerading (T1036) with moderate to high confidence (80%), supported by evidence indicating fake Google API Connector update prompt and phishing pages as legitimate apps and Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate to high confidence (70%), supported by evidence indicating malware may hide artifacts during data extraction (e.g., `tdata` directory). Under the Lateral Movement tactic, the analysis identified Use Alternate Authentication Material: Web Session Cookie (T1550.004) with moderate to high confidence (80%), supported by evidence indicating hijacks Telegram sessions by copying `tdata` directory for active access. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate confidence (50%), supported by evidence indicating wallet databases are locally encrypted, but paired with stolen credentials and Financial Theft (T1657) with high confidence (95%), supported by evidence indicating offline cryptocurrency theft via decrypted wallet data and recovery phrases. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.