Incident Score: Analysis & Impact (FIR1781188040)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with high confidence (95%), with evidence including supply-chain compromise of FireAnt MetaKit, and exploited FireAnt’s unencrypted HTTP update mechanism and Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), supported by evidence indicating initial access likely exploited RCE vulnerabilities in public SQL servers. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (85%), supported by evidence indicating deployed its SPECTRALVIPER backdoor via legitimate update URL and Hijack Execution Flow: DLL Side-Loading (T1574.002) with high confidence (90%), supported by evidence indicating side-loading chain involving DtlCrashCatch.dll (SPECTRALVIPER loader). Under the Persistence tactic, the analysis identified Hijack Execution Flow: DLL Side-Loading (T1574.002) with high confidence (90%), supported by evidence indicating side-loaded via legitimate executables (e.g., Toolbox.exe) and Event Triggered Execution: Image File Execution Options Injection (T1546.012) with moderate to high confidence (70%), supported by evidence indicating injected into OneDrive.Sync.Service.exe. Under the Privilege Escalation tactic, the analysis identified Hijack Execution Flow: DLL Side-Loading (T1574.002) with moderate to high confidence (85%), supported by evidence indicating dtlCrashCatch.dll (SPECTRALVIPER loader) alongside legitimately signed executable. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with high confidence (90%), with evidence including heavily obfuscated downloaders, and encrypted host data embedded in HTTP cookie headers, Masquerading: Match Legitimate Name or Location (T1036.005) with moderate to high confidence (85%), supported by evidence indicating renamed, legitimately signed executable (IntelAudioService.exe), and Hijack Execution Flow: DLL Side-Loading (T1574.002) with high confidence (90%), supported by evidence indicating side-loaded via legitimate executables (e.g., Toolbox.exe). Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with moderate to high confidence (70%), supported by evidence indicating host reconnaissance, sent profiling data to staging server. Under the Discovery tactic, the analysis identified System Information Discovery (T1082) with high confidence (90%), supported by evidence indicating downloader performed host reconnaissance, sent profiling data and System Network Configuration Discovery (T1016) with moderate to high confidence (80%), supported by evidence indicating campaign-specific infrastructure (financemachinelearning.com). Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with high confidence (95%), supported by evidence indicating beaconing to HTTPS C2 servers with encrypted host data in HTTP cookie headers, Ingress Tool Transfer (T1105) with high confidence (90%), supported by evidence indicating served malicious payloads via legitimate update URL, and Encrypted Channel: Symmetric Cryptography (T1573.001) with moderate to high confidence (85%), supported by evidence indicating encrypted host data embedded in HTTP cookie headers (zd_cs_pm= prefix). Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (95%), with evidence including data exfiltration via HTTPS C2 servers, and long-running espionage campaign and Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002) with moderate to high confidence (70%), supported by evidence indicating named pipes used for command relay between infected systems. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating host profiling data collected and sent to staging server and Automated Collection (T1119) with moderate to high confidence (80%), supported by evidence indicating sPECTRALVIPER backdoor with orchestration capabilities. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.