Incident Score: Analysis & Impact (DJIJPMTELGOO1789086449)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.002) with high confidence (90%), supported by evidence indicating multi-chain redirect tactic, leveraging Cisco’s infrastructure and trusted services, Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), supported by evidence indicating critical Flaws in BMC FootPrints ITSM Enable Pre-Auth Remote Code Execution, Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with moderate to high confidence (70%), supported by evidence indicating six trojanized Packagist packages, posing as OphimCMS themes, and Phishing: Spearphishing Attachment (T1566.001) with moderate to high confidence (70%), supported by evidence indicating teams Phishing Campaigns Impersonate IT Staff for Remote Access. Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with moderate to high confidence (80%), supported by evidence indicating pre-authentication remote code execution (RCE) in BMC FootPrints and User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating snappyClient distributed via a fake Telefónica website. Under the Persistence tactic, the analysis identified Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001) with moderate confidence (60%), supported by evidence indicating snappyClient employs evasion techniques like transacted hollowing. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate to high confidence (80%), supported by evidence indicating authentication bypass (CVE-2025-71257) in BMC FootPrints. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with high confidence (90%), supported by evidence indicating snappyClient uses AMSI bypass, Heaven’s Gate, direct system calls, Deobfuscate/Decode Files or Information (T1140) with moderate to high confidence (70%), supported by evidence indicating aOT-compiled malware evades analysis by stripping .NET metadata, and Subvert Trust Controls: Mark-of-the-Web Bypass (T1553.005) with moderate confidence (60%), supported by evidence indicating cloudflare-based human validation step to evade security filters. Under the Credential Access tactic, the analysis identified Credentials from Password Stores (T1555) with high confidence (90%), supported by evidence indicating snappyClient steals data from browsers, extensions, and applications, Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001) with moderate confidence (60%), supported by evidence indicating liveChat phishing campaign to harvest credentials, credit card details, and Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (90%), supported by evidence indicating 28.65 million new secrets exposed in public GitHub commits. Under the Discovery tactic, the analysis identified Account Discovery: Local Account (T1087.001) with moderate to high confidence (70%), supported by evidence indicating snappyClient targets browser data and extensions for credential discovery. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating snappyClient steals data from browsers, extensions, and applications and Automated Collection (T1119) with moderate to high confidence (80%), supported by evidence indicating malicious Packagist themes exfiltrate URLs and inject ads. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with high confidence (90%), supported by evidence indicating snappyClient such as A Stealthy C2 Framework Targeting Cryptocurrency Theft. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating snappyClient steals data from browsers, extensions, and applications and Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (T1048.003) with moderate to high confidence (70%), supported by evidence indicating malicious Packagist themes exfiltrate URLs and redirect users. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate confidence (50%), supported by evidence indicating the Gentlemen RaaS group emerged in mid-2025 and Defacement: Internal Defacement (T1491.001) with moderate confidence (60%), supported by evidence indicating malicious Packagist themes inject ads and redirect users. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.