Incident Score: Analysis & Impact (APPL3H1773147416)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Drive-by Compromise (T1189) with high confidence (90%), with evidence including targeting iPhones...via watering-hole attacks, and single visit to a compromised website can trigger and Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (70%), supported by evidence indicating watering-hole attacks...highly targeted operations. Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with high confidence (95%), supported by evidence indicating 23 exploits across five attack chains...remote code execution. Under the Privilege Escalation tactic, the analysis identified Escape to Host (T1611) with high confidence (90%), supported by evidence indicating sandbox escape...enabling attackers to...kernel compromise and Exploitation for Privilege Escalation (T1068) with high confidence (90%), supported by evidence indicating kernel compromise...targeting iPhones running iOS 13 through 17.2.1. Under the Defense Evasion tactic, the analysis identified Exploitation for Defense Evasion (T1211) with high confidence (90%), supported by evidence indicating 23 exploits...zero-day exploits...sandbox escape and Obfuscated Files or Information (T1027) with moderate to high confidence (70%), supported by evidence indicating sophisticated iOS exploit toolkit called Coruna. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with moderate to high confidence (80%), supported by evidence indicating drain cryptocurrency wallets...sensitive user data. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating steal data...sensitive user data...cryptocurrency wallets and Screen Capture (T1113) with moderate to high confidence (70%), supported by evidence indicating spy on victims...surveillance. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data breach...data exfiltration such as Yes and Exfiltration Over Alternative Protocol (T1048) with moderate to high confidence (70%), supported by evidence indicating russian state hackers...Chinese cybercrime group. Under the Impact tactic, the analysis identified Endpoint Denial of Service: Application or System Exploitation (T1499.004) with moderate confidence (60%), supported by evidence indicating kernel compromise...millions of devices (potential) and Data Encrypted for Impact (T1486) with lower confidence (40%), supported by evidence indicating no details on malware’s encryption capabilities. Under the Resource Development tactic, the analysis identified Obtain Capabilities: Tool (T1588.002) with high confidence (95%), supported by evidence indicating coruna toolkit developed in-house by L3Harris...sold exclusively to U.S. government and Develop Capabilities: Malware (T1587.001) with high confidence (90%), supported by evidence indicating 23 exploits across five attack chains...sophisticated iOS exploit toolkit. Under the Lateral Movement tactic, the analysis identified Exploitation of Remote Services (T1210) with moderate to high confidence (70%), supported by evidence indicating shared modules such as Photon, Gallium, and Plasma. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.