Incident Score: Analysis & Impact (FOR1777631221)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified External Remote Services (T1133) with high confidence (90%), supported by evidence indicating 1.8 million RDP and 1.6 million VNC servers exposed to the internet, Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), with evidence including blueKeep flaw in RDP servers, and disabled authentication in 60,000 VNC servers, and Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating vPNs and jump hosts often rely on shared credentials. Under the Execution tactic, the analysis identified Command and Scripting Interpreter (T1059) with moderate confidence (60%), supported by evidence indicating tRK25 ADVANCED SCADA scanner probes RDP, VNC, and OT protocols. Under the Persistence tactic, the analysis identified External Remote Services (T1133) with moderate to high confidence (80%), supported by evidence indicating undocumented access pathways by OEMs/contractors operate without oversight. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate to high confidence (70%), with evidence including blueKeep flaw in RDP servers, and outdated software (EOL Windows versions). Under the Defense Evasion tactic, the analysis identified Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating disabled authentication in nearly 60,000 VNC servers and Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating shared credentials in VPNs and jump hosts. Under the Credential Access tactic, the analysis identified Brute Force (T1110) with high confidence (90%), supported by evidence indicating brute-force attacks on exposed VNC servers by hacktivist groups and Unsecured Credentials: Credentials In Files (T1552.001) with moderate confidence (60%), supported by evidence indicating shared credentials in insecure remote access practices. Under the Discovery tactic, the analysis identified Network Service Discovery (T1046) with moderate to high confidence (80%), supported by evidence indicating tRK25 ADVANCED SCADA scanner probes RDP, VNC, Modbus, OPC and Network Share Discovery (T1135) with moderate confidence (50%), supported by evidence indicating exposed RDP/VNC servers in industrial environments. Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with high confidence (90%), supported by evidence indicating exposed RDP servers (1.8M) enabling lateral movement and Remote Services: VNC (T1021.005) with moderate to high confidence (80%), supported by evidence indicating exposed VNC servers (1.6M) linked to OT/ICS. Under the Collection tactic, the analysis identified Screen Capture (T1113) with moderate to high confidence (70%), supported by evidence indicating tRK25 ADVANCED SCADA scanner captures screenshots of compromised systems. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate confidence (60%), supported by evidence indicating sale of access to a Czech SCADA system. Under the Impact tactic, the analysis identified Data Manipulation (T0883) with moderate confidence (50%), supported by evidence indicating potential unauthorized access to critical infrastructure and Loss of Control (T0829) with moderate to high confidence (70%), supported by evidence indicating breach of an Israeli groundwater pumping station. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.