Incident Score: Analysis & Impact (ANTGOOOPE1790576637)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), supported by evidence indicating scans for Docker daemons with unauthenticated access on port 2375. Under the Execution tactic, the analysis identified Container Administration Command (T1609) with high confidence (90%), supported by evidence indicating deploys a privileged container that mounts the host’s filesystem and Command and Scripting Interpreter (T1059) with moderate to high confidence (80%), supported by evidence indicating aI-driven agent executes tasks via Telegram commands. Under the Persistence tactic, the analysis identified Scheduled Task/Job: Cron (T1053.003) with high confidence (90%), supported by evidence indicating establishes persistence via cron, Create or Modify System Process: Systemd Service (T1543.002) with high confidence (90%), supported by evidence indicating establishes persistence via systemd, and Boot or Logon Autostart Execution: RC Scripts (T1547.004) with moderate to high confidence (80%), supported by evidence indicating establishes persistence via rc.local and OpenRC. Under the Privilege Escalation tactic, the analysis identified Escape to Host (T1611) with high confidence (90%), supported by evidence indicating deploys a privileged container that mounts the host’s filesystem. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with moderate to high confidence (80%), supported by evidence indicating mimics legitimate processes (e.g., naming its container systemd-resolved). Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (90%), supported by evidence indicating prioritizes the theft of AI API keys, SSH credentials, tokens. Under the Discovery tactic, the analysis identified Network Service Discovery (T1046) with high confidence (90%), supported by evidence indicating scans attached networks and Docker bridges for exposed Docker APIs. Under the Lateral Movement tactic, the analysis identified Remote Services: SSH (T1021.004) with high confidence (90%), supported by evidence indicating opens a reverse SSH tunnel for operator access, Remote Service Session Hijacking: RDP Hijacking (T1563.002) with moderate to high confidence (70%), supported by evidence indicating installs an SSH server and adds attacker-controlled keys, and Account Discovery: Domain Account (T1087.002) with moderate to high confidence (70%), supported by evidence indicating lateral movement via Docker bridges to new hosts. Under the Command and Control tactic, the analysis identified Ingress Tool Transfer (T1105) with moderate to high confidence (80%), supported by evidence indicating deploys implant to new hosts via exposed Docker APIs, Application Layer Protocol: Web Protocols (T1071.001) with high confidence (90%), supported by evidence indicating sends Telegram deployment reports with host details, and Proxy: Internal Proxy (T1090.001) with moderate to high confidence (80%), supported by evidence indicating reverse SSH tunnel for operator access. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration via Telegram deployment reports and LLM gateway. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (80%), supported by evidence indicating hijacks exposed Docker servers for AI API key theft. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.