Incident Score: Analysis & Impact (FLA1770252228)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (50%), supported by evidence indicating sMB port scanning to identify targets and Phishing: Spearphishing Attachment (T1566.001) with lower confidence (40%), supported by evidence indicating raaS model implies phishing as a likely initial vector. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: Windows Command Shell (T1059.003) with moderate to high confidence (70%), supported by evidence indicating customizable encryption models for Windows systems, Command and Scripting Interpreter: Unix Shell (T1059.004) with moderate to high confidence (70%), supported by evidence indicating customizable encryption models for Linux and ESXi systems, and User Execution: Malicious File (T1204.002) with moderate confidence (60%), supported by evidence indicating delayed execution feature in ransomware tools. Under the Persistence tactic, the analysis identified Scheduled Task/Job: Scheduled Task (T1053.005) with moderate confidence (50%), supported by evidence indicating delayed execution feature implies persistence mechanisms. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate confidence (50%), supported by evidence indicating multithreading for faster attacks suggests privilege escalation. Under the Defense Evasion tactic, the analysis identified Indicator Removal: File Deletion (T1070.004) with moderate to high confidence (80%), supported by evidence indicating ability to delete shadow copies and Execution Guardrails: Environmental Keying (T1480.001) with moderate confidence (60%), supported by evidence indicating optimized encryption speeds imply evasion of detection. Under the Credential Access tactic, the analysis identified Brute Force: Password Spraying (T1110.003) with moderate confidence (50%), supported by evidence indicating sMB port scanning implies credential access attempts. Under the Discovery tactic, the analysis identified Network Service Discovery (T1046) with moderate to high confidence (80%), supported by evidence indicating sMB port scanning to identify targets and File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating company Data Audit service to assess stolen data’s value. Under the Lateral Movement tactic, the analysis identified Remote Services: SMB/Windows Admin Shares (T1021.002) with moderate to high confidence (70%), supported by evidence indicating sMB port scanning to identify targets. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating company Data Audit service to assess stolen data’s value. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate confidence (60%), supported by evidence indicating 24/7 server monitoring and decryption services. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration confirmed in ransomware details and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate to high confidence (70%), supported by evidence indicating petabytes of storage provided to affiliates. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating data encryption confirmed in ransomware details and Data Destruction (T1485) with moderate to high confidence (70%), supported by evidence indicating ability to delete shadow copies. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.