Incident Score: Analysis & Impact (NPMGLU1778552678)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise (T1195) with high confidence (95%), with evidence including supply chain attack targeting GlueStack and other npm packages, and 13 packages under @gluestack-ui and @react-native-aria namespaces affected and Compromise Software Supply Chain (T1195.002) with high confidence (90%), with evidence including compromised access token belonging to a contributor allowed malicious updates, and malicious PyPI packages (imad213, poppo213) discovered. Under the Execution tactic, the analysis identified Command and Scripting Interpreter (T1059) with moderate to high confidence (85%), with evidence including malware capable of executing shell commands, and wiper malware executes `rm -rf *` upon receiving hard-coded key and User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), with evidence including nearly 1 million weekly downloads of malicious npm packages, and 3,242+ downloads of malicious PyPI packages. Under the Persistence tactic, the analysis identified Server Software Component: Transport Agent (T1505.002) with moderate to high confidence (70%), supported by evidence indicating malware’s persistence mechanism could maintain access even after updates. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (85%), supported by evidence indicating compromised access token belonging to a contributor allowed malicious updates. Under the Defense Evasion tactic, the analysis identified Masquerading (T1036) with high confidence (90%), with evidence including `express-api-sync` masquerades as a database sync tool, and `imad213` poses as an Instagram growth tool and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate to high confidence (70%), supported by evidence indicating remote kill switch hosted on Netlify to disable malware. Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle (T1557) with moderate to high confidence (85%), supported by evidence indicating python-based credential harvester prompts users for Instagram credentials and Input Capture: Keylogging (T1056.001) with moderate to high confidence (70%), supported by evidence indicating credential harvester targets Facebook, Gmail, Twitter, and VK credentials. Under the Discovery tactic, the analysis identified System Information Discovery (T1082) with moderate to high confidence (80%), supported by evidence indicating malware includes commands (`ss_info` and `ss_ip`) to harvest system data and public IP addresses. Under the Collection tactic, the analysis identified Screen Capture (T1113) with moderate to high confidence (80%), supported by evidence indicating malware capable of capturing screenshots and Data from Local System (T1005) with moderate to high confidence (85%), with evidence including malware exfiltrates files, and system details sent via SMTP email. Under the Command and Control tactic, the analysis identified Remote Access Software (T1219) with high confidence (90%), supported by evidence indicating updated remote access trojan (RAT) with new commands for data harvesting. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (85%), with evidence including data exfiltrated via remote access trojan, and system details sent via SMTP email. Under the Impact tactic, the analysis identified Data Destruction (T1485) with high confidence (90%), with evidence including wiper malware executes `rm -rf *` to delete all files in current directory, and oS-specific deletion commands in `system-health-sync-api` and Resource Hijacking (T1496) with moderate to high confidence (70%), supported by evidence indicating dDoS tool (`poppo213`) discovered among malicious PyPI packages. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.