Incident Score: Analysis & Impact (JAMHUNSNYRECHACLASTANKLUBEY1784126732)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with high confidence (95%), with evidence including dormant credential issued by Klue in 2022 became the entry point, and exploited an unmonitored OAuth token to access Salesforce environments and Trusted Relationship (T1199) with high confidence (90%), with evidence including fourth-party risk such as a vendor’s vendor (Klue) becoming the weak link, and oAuth tokens to pull data from connected Salesforce instances. Under the Credential Access tactic, the analysis identified Steal Application Access Token (T1528) with high confidence (95%), with evidence including exploited an unmonitored OAuth token to access Salesforce environments, and legacy credential originally created for a limited pilot. Under the Lateral Movement tactic, the analysis identified Account Discovery: Cloud Account (T1087.004) with moderate to high confidence (80%), with evidence including accessed Salesforce environments en masse, and automated data exfiltration from 195–200 companies. Under the Collection tactic, the analysis identified Data from Cloud Storage Object: Cloud Storage (T1213.001) with high confidence (90%), with evidence including data theft from an unspecified number of customers, and business contact and CRM data compromised. Under the Exfiltration tactic, the analysis identified Transfer Data to Cloud Account (T1537) with high confidence (90%), with evidence including automated data exfiltration from 195–200 companies, and data exfiltration such as true and Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), with evidence including attackers used a compromised legacy credential to infiltrate, and ransom note from attackers via compromised email. Under the Impact tactic, the analysis identified Defacement: Internal Defacement (T1491.001) with moderate confidence (60%), with evidence including brand reputation impact such as heightened procurement scrutiny, and security vendors facing procurement questions. Under the Defense Evasion tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with high confidence (90%), with evidence including unmonitored legacy credential (4-year-old OAuth token), and no zero-day exploits or sophisticated malware used and Use Alternate Authentication Material: Application Access Token (T1550.001) with high confidence (90%), with evidence including exploited an unmonitored OAuth token, and oAuth tokens to pull data from Salesforce. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.