Incident Score: Analysis & Impact (UNINAMIONGOD1770273279)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), with evidence including scanned WordPress sites for vulnerabilities, and wordPress vulnerabilities exploited and External Remote Services (T1133) with moderate to high confidence (70%), with evidence including compromised systems into SOCKS5 proxies, and hosting providers targeted. Under the Execution tactic, the analysis identified Command and Scripting Interpreter (T1059) with high confidence (90%), with evidence including perl-based Linux variant evaded detection, and droppers like SafeObject unpack 264 payloads and Exploitation for Client Execution (T1203) with moderate to high confidence (70%), with evidence including wordPress vulnerabilities exploited, and broader exploitation campaigns. Under the Persistence tactic, the analysis identified Account Manipulation (T1098) with moderate confidence (60%), supported by evidence indicating some systems remained compromised for over 100 days and Server Software Component: Web Shell (T1505.003) with moderate to high confidence (70%), with evidence including scanned WordPress sites for vulnerabilities, and backconnect setup. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with high confidence (90%), with evidence including rC4-encrypted custom protocols, and perl variant evaded all 62 VirusTotal scanners, Hide Artifacts: Hidden Window (T1564.003) with moderate confidence (60%), supported by evidence indicating backconnect setup obscures malicious operations, and Valid Accounts (T1078) with moderate confidence (50%), supported by evidence indicating hosting providers targeted for high-bandwidth access. Under the Command and Control tactic, the analysis identified Proxy (T1090) with high confidence (90%), with evidence including converts compromised systems into SOCKS5 proxies, and 10,340 unique infected IPs, Encrypted Channel (T1573) with moderate to high confidence (80%), with evidence including rC4-encrypted custom protocols, and backconnect setup, and Dynamic Resolution (T1568) with moderate to high confidence (70%), supported by evidence indicating bulletproof hosting providers like bthoster.com. Under the Impact tactic, the analysis identified Network Denial of Service (T1498) with high confidence (90%), with evidence including dDoS attacks launched via botnet, and 10,340+ infected IPs for high-bandwidth access and Data Encrypted for Impact (T1486) with moderate to high confidence (70%), with evidence including malware functions as ransomware loader, and rC4-encrypted custom protocols. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.