Incident Score: Analysis & Impact (GRO1787156738)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (95%), supported by evidence indicating aI-generated voice calls, live phishing pages to hijack customer accounts, Phishing: Spearphishing Voice (T1566.002) with high confidence (90%), supported by evidence indicating aI-driven voice synthesis impersonating bank representatives (e.g., Carolina), and Drive-by Compromise (T1189) with moderate to high confidence (80%), supported by evidence indicating malicious Android app disguised as bank-protection alert delivered via fake pages. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with high confidence (90%), supported by evidence indicating malicious Android app (package name `sacred.explosion`) installed by victims and Inter-Process Communication: Dynamic Data Exchange (T1559.002) with moderate to high confidence (70%), supported by evidence indicating spyroid RAT exfiltrates screen content, keystrokes, SMS messages via C2. Under the Persistence tactic, the analysis identified Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001) with moderate confidence (60%), supported by evidence indicating spyroid-based RAT enables prolonged device control on Android. Under the Privilege Escalation tactic, the analysis identified Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003) with moderate confidence (50%), supported by evidence indicating rAT may exploit Android permissions to access SMS, banking apps. Under the Defense Evasion tactic, the analysis identified Masquerading (T1036) with high confidence (90%), supported by evidence indicating malicious app disguised as bank-protection alert; phishing pages mimic banks, Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating rAT may disable security features on compromised Android devices, and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (80%), supported by evidence indicating stolen credentials and MFA codes used to access legitimate bank accounts. Under the Credential Access tactic, the analysis identified Input Capture: Keylogging (T1056.001) with high confidence (90%), supported by evidence indicating spyroid RAT captures keystrokes and banking app activity, Adversary-in-the-Middle: DHCP Spoofing (T1557.003) with moderate to high confidence (70%), supported by evidence indicating real-time relay of MFA prompts via WebSocket to intercept codes, and Forge Web Credentials: SAML Tokens (T1606.002) with moderate confidence (50%), supported by evidence indicating fake verification screens capture SMS codes and ATM PINs. Under the Discovery tactic, the analysis identified File and Directory Discovery (T1420) with moderate to high confidence (70%), supported by evidence indicating spyroid RAT exfiltrates screen content and banking app activity and Account Discovery: Local Account (T1087.001) with moderate confidence (60%), supported by evidence indicating rAT accesses SMS messages and installed apps on Android devices. Under the Collection tactic, the analysis identified Screen Capture (T1113) with moderate to high confidence (80%), supported by evidence indicating spyroid RAT exfiltrates screen content from compromised devices, Data from Local System (T1005) with high confidence (90%), supported by evidence indicating credentials, financial data, SMS messages, banking app activity collected, and Video Capture (T1125) with moderate confidence (60%), supported by evidence indicating rAT may capture video from compromised Android devices. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with high confidence (90%), supported by evidence indicating webSocket connection synchronizes phishing pages with attacker control panel and Non-Application Layer Protocol (T1095) with moderate to high confidence (70%), supported by evidence indicating rAT C2 server at `196.251.84.11 such as 7771/TCP`. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating spyroid RAT exfiltrates data via C2 server; 1,100+ victims compromised and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (50%), supported by evidence indicating potential exfiltration of stolen data to attacker-controlled cloud storage. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with lower confidence (30%), supported by evidence indicating no evidence of ransomware, but financial fraud may disrupt services and Financial Theft (T1657) with high confidence (90%), supported by evidence indicating account hijacking, unauthorized transactions, large-scale banking fraud. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.