Incident Score: Analysis & Impact (FORPALGITIVA1782980964)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise: Compromise Software Dependencies and Development Tools (T1195.002) with high confidence (95%), with evidence including exploited GitHub proof-of-concept (PoC) repositories to deploy RAT, and malicious entries in requirements.txt (frint, skytext) and Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (80%), supported by evidence indicating tricking victims into installing malicious dependencies under guise of legitimate exploit tools. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: Python (T1059.006) with high confidence (90%), with evidence including pip install executed malicious Python extension (gradient.so/pyd), and choco.py downloader executed via Python and User Execution: Malicious File (T1204.002) with moderate to high confidence (85%), supported by evidence indicating researchers ran pip install on malicious requirements.txt. Under the Persistence tactic, the analysis identified Hijack Execution Flow: DLL Search Order Hijacking (T1574.001) with moderate to high confidence (80%), supported by evidence indicating trojanized _distutils_hack package and malicious .pth files in site-packages and Event Triggered Execution: Component Object Model Hijacking (T1546.015) with moderate to high confidence (70%), supported by evidence indicating malicious .pth files ensure execution on every Python interpreter startup. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with high confidence (90%), supported by evidence indicating obfuscated code with anti-analysis measures (debugger detection, environment gates), Virtualization/Sandbox Evasion: System Checks (T1497.001) with moderate to high confidence (85%), supported by evidence indicating malware remains dormant in sandboxes, triggered by filename hash match, and Indicator Removal: File Deletion (T1070.004) with moderate to high confidence (70%), supported by evidence indicating ephemeral GitHub/PyPI accounts with identical operational patterns. Under the Credential Access tactic, the analysis identified Credentials from Password Stores: Credentials from Web Browsers (T1555.003) with high confidence (95%), supported by evidence indicating credential theft (Chrome, Edge, Brave, Firefox) and Unsecured Credentials: Bash History (T1552.003) with moderate to high confidence (80%), supported by evidence indicating shell history harvesting. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating file exfiltration, system reconnaissance data collection and Automated Collection (T1119) with moderate to high confidence (80%), supported by evidence indicating malware polls C2 for further instructions, executes arbitrary commands. Under the Command and Control tactic, the analysis identified Application Layer Protocol: DNS-over-HTTPS (DoH) (T1071.004) with high confidence (90%), supported by evidence indicating dNS-over-HTTPS (DoH) to resolve api.mapbox.com to attacker IP and Web Service: Bidirectional Communication (T1102.002) with moderate to high confidence (85%), supported by evidence indicating mapbox datasets used as covert C2 channel for Base64-encoded payloads. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration via Mapbox C2 channel and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate to high confidence (80%), supported by evidence indicating mapbox datasets used for exfiltration. Under the Reconnaissance tactic, the analysis identified Active Scanning: Vulnerability Scanning (T1595.002) with moderate to high confidence (70%), supported by evidence indicating targeted high-severity CVEs (FortiWeb, Ivanti Sentry, PAN-OS). These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.