Incident Score: Analysis & Impact (AXIGOO1775048584)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with high confidence (90%), with evidence including compromised a software developer’s account tied to Axios, and pushing malicious updates to organizations and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (80%), supported by evidence indicating attackers gained control of the developer’s account for three hours. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating pushing malicious updates to organizations that downloaded the software. Under the Persistence tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (70%), supported by evidence indicating attackers gained control of the developer’s account for three hours. Under the Privilege Escalation tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (70%), supported by evidence indicating compromised a software developer’s account tied to Axios. Under the Defense Evasion tactic, the analysis identified Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with moderate to high confidence (80%), supported by evidence indicating pushing malicious updates via legitimate software distribution. Under the Credential Access tactic, the analysis identified Steal Application Access Token (T1528) with moderate to high confidence (70%), supported by evidence indicating compromised a software developer’s account tied to Axios. Under the Collection tactic, the analysis identified Data from Information Repositories: Code Repositories (T1213.001) with moderate confidence (60%), supported by evidence indicating targeting cryptocurrency firms, blockchain developers. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), with evidence including aimed at stealing cryptocurrency, and north Korea-linked threat actor. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (70%), supported by evidence indicating stealing cryptocurrency to fund nuclear/missile programs. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.