Incident Score: Analysis & Impact (GOO1779352039)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), with evidence including publicly exposed Redis services, and exploiting misconfigured Redis instances, Exploitation of Remote Services (T1210) with moderate to high confidence (80%), with evidence including cVE-2025-11953 (Metro4Shell), and possible CVE-2025-49844 (RediShell), and External Remote Services (T1133) with moderate to high confidence (70%), supported by evidence indicating exposed Redis instances to infiltrate GKE clusters. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: Unix Shell (T1059.004) with high confidence (90%), supported by evidence indicating shell-based dropper script (deplyoer.sh) and Exploitation for Client Execution (T1203) with moderate to high confidence (80%), supported by evidence indicating cVE-2025-11953 (Metro4Shell) RCE vulnerability. Under the Persistence tactic, the analysis identified Server Software Component: Web Shell (T1505.003) with moderate to high confidence (70%), supported by evidence indicating p2Pinfect maintains access for up to six months and Create or Modify System Process: Windows Service (T1543.003) with moderate confidence (50%), supported by evidence indicating botnet integration into infected systems. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with high confidence (90%), with evidence including uPX-packed Rust binary, and chaCha20 encryption for obfuscation, Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating abused Redis replication features (SLAVEOF command), and Hide Artifacts: Hidden Window (T1564.003) with moderate to high confidence (70%), supported by evidence indicating user-mode rootkit functionality for stealth. Under the Command and Control tactic, the analysis identified Proxy (T1090) with moderate to high confidence (80%), supported by evidence indicating decentralized mesh of infected nodes (P2P botnet) and Encrypted Channel (T1573) with moderate to high confidence (70%), supported by evidence indicating non-standard ports for communication. Under the Lateral Movement tactic, the analysis identified Exploitation of Remote Services (T1210) with moderate to high confidence (80%), supported by evidence indicating self-propagating botnet targeting GKE clusters. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate confidence (60%), supported by evidence indicating cryptominers tied to React2Shell campaign on compromised nodes. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.