Incident Score: Analysis & Impact (GOO1772541330)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), with evidence including a newly uncovered phishing campaign, dubbed GTFire, and attackers use Firebase’s *.web.app* subdomains to host fake login pages and Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (80%), supported by evidence indicating google Translate cloaks phishing links within the *translate.goog* domain. Under the Credential Access tactic, the analysis identified Input Capture: Keylogging (T1056.001) with moderate to high confidence (80%), supported by evidence indicating victims are prompted to enter credentials, with incorrect attempts triggering repeated login prompts, Brute Force: Password Guessing (T1110.001) with moderate to high confidence (70%), supported by evidence indicating incorrect attempts triggering repeated login prompts to maximize data collection, and Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001) with lower confidence (30%), supported by evidence indicating multi-step redirection process, making it difficult for security systems to flag. Under the Defense Evasion tactic, the analysis identified Subvert Trust Controls: Install Root Certificate (T1553.004) with moderate confidence (50%), supported by evidence indicating exploits Google’s infrastructure to host malicious login pages and disguise phishing URLs, Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), supported by evidence indicating firebase’s *.web.app* subdomains...commonly associated with legitimate development projects, Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating abusing trusted cloud services to evade detection, and Dynamic Resolution: Domain Generation Algorithms (T1568.002) with lower confidence (40%), supported by evidence indicating multi-step redirection process, making it difficult for security systems to flag. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating metadata such as the victim’s email, location, and browser language and Automated Collection (T1119) with moderate to high confidence (70%), supported by evidence indicating pre-packaged PHP phishing scripts hosted on LiteSpeed Web Servers. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating stolen credentials are Base64-encoded and transmitted via HTTP GET requests to attacker-controlled C2 servers and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (50%), supported by evidence indicating abusing trusted cloud services to evade detection. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (80%), supported by evidence indicating transmitted via HTTP GET requests to attacker-controlled command-and-control (C2) servers and Web Service: Bidirectional Communication (T1102.002) with moderate confidence (60%), supported by evidence indicating multi-step redirection process, making it difficult for security systems to flag. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.