Incident Score: Analysis & Impact (STRGUA1775478818)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise: Compromise Software Dependencies and Development Tools (T1195.001) with high confidence (95%), with evidence including 36 malicious NPM packages published across four accounts, and supply chain attack has compromised the Strapi ecosystem. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: Unix Shell (T1059.004) with high confidence (90%), with evidence including redis exploitation to inject crontab entries, and node.js reverse shells deployed and Exploitation for Client Execution (T1203) with moderate to high confidence (85%), with evidence including redis code execution, and docker container escape via overlay filesystem discovery. Under the Persistence tactic, the analysis identified Scheduled Task/Job: Cron (T1053.003) with high confidence (90%), supported by evidence indicating redis exploitation to inject crontab entries, Server Software Component: Web Shell (T1505.003) with moderate to high confidence (85%), supported by evidence indicating pHP webshells deployed, and Account Manipulation: SSH Authorized Keys (T1098.004) with moderate to high confidence (80%), supported by evidence indicating sSH keys deployed. Under the Privilege Escalation tactic, the analysis identified Escape to Host (T1611) with high confidence (90%), supported by evidence indicating docker container escape via overlay filesystem discovery. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with moderate to high confidence (85%), supported by evidence indicating plugin naming conventions tailored for Strapi users and Hide Artifacts: Hidden Window (T1564.003) with moderate to high confidence (70%), supported by evidence indicating persistent implants deployed. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (90%), supported by evidence indicating credential theft from Elasticsearch and cryptocurrency wallets and Unsecured Credentials: Private Keys (T1552.004) with moderate to high confidence (85%), with evidence including sSH keys deployed, and cryptocurrency wallet/key files targeted. Under the Discovery tactic, the analysis identified File and Directory Discovery (T1083) with moderate to high confidence (80%), supported by evidence indicating targeted file paths linked to Strapi’s Docker images and Network Service Discovery (T1046) with moderate to high confidence (75%), supported by evidence indicating elasticsearch and PostgreSQL databases targeted. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), with evidence including guardarian API module exfiltrated, and strapi configurations targeted. Under the Command and Control tactic, the analysis identified Ingress Tool Transfer (T1105) with moderate to high confidence (85%), supported by evidence indicating reverse shell deployment. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), with evidence including data exfiltration risk, and guardarian API module exfiltrated. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (70%), supported by evidence indicating cryptocurrency wallet/key files targeted. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.