Incident Score: Analysis & Impact (AMEMEREDEHIGCET1775075723)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (80%), supported by evidence indicating unauthorized actor accessed an employee’s email account and Exploit Public-Facing Application (T1190) with moderate confidence (60%), supported by evidence indicating salesforce records compromised in ransomware attack. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate confidence (50%), supported by evidence indicating ransomware attack by ShinyHunters. Under the Credential Access tactic, the analysis identified Brute Force: Password Guessing (T1110.001) with moderate to high confidence (70%), supported by evidence indicating unauthorized actor accessed an employee’s email account and Credentials from Password Stores (T1555) with moderate confidence (60%), supported by evidence indicating client data including names, Social Security numbers exposed. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating 200GB of internal data compromised (Ameriprise) and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating salesforce records containing PII compromised. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating 200GB of internal data (Ameriprise) and Exfiltration Over Alternative Protocol (T1048) with moderate confidence (60%), supported by evidence indicating data breach with long-term identity theft risk. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate confidence (50%), supported by evidence indicating ransomware attack by ShinyHunters and Defacement: Internal Defacement (T1491.001) with lower confidence (40%), supported by evidence indicating salesforce records compromised. Under the Defense Evasion tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (70%), supported by evidence indicating employee’s email account accessed by unauthorized actor and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (50%), supported by evidence indicating failed to notify victims (Ameriprise). These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.