Incident Score: Analysis & Impact (MINLAT1773852600)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (60%), supported by evidence indicating new Zealand’s largest health portal, Manage My Health, suffered a significant cybersecurity incident and Trusted Relationship (T1199) with moderate confidence (50%), supported by evidence indicating risks of supply chain attacks, where third-party vendors with weaker security become entry points. Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with moderate confidence (50%), supported by evidence indicating ransomware attack with data exfiltration and encryption threats. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with lower confidence (40%), supported by evidence indicating attackers accessed 400,000 documents from 126,000 patients. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (50%), supported by evidence indicating sensitive patient data accessed, implying elevated privileges. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate confidence (60%), supported by evidence indicating ransomware attack with data exfiltration; likely used obfuscation and Impair Defenses: Disable or Modify Tools (T1562.001) with lower confidence (40%), supported by evidence indicating 2021 Waikato DHB breach involved outdated security (Windows XP). Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with moderate confidence (50%), supported by evidence indicating access to 400,000 documents suggests credential compromise and Brute Force (T1110) with lower confidence (40%), supported by evidence indicating healthcare sector targeted; weak authentication risks noted. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate confidence (60%), supported by evidence indicating 126,000 patients affected; likely targeted account discovery and File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating 400,000 documents stolen; implies extensive file discovery. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating 400,000 documents stolen from Manage My Health portal and Data from Network Shared Drive (T1039) with moderate confidence (60%), supported by evidence indicating health portal likely used shared drives for patient records. Under the Command and Control tactic, the analysis identified Application Layer Protocol (T1071) with moderate confidence (60%), supported by evidence indicating ransomware attack with $60,000 demand implies C2 communication. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating attackers stole 400,000 documents and threatened to release data and Exfiltration Over Web Service (T1567) with moderate confidence (50%), supported by evidence indicating data exfiltration common in ransomware attacks. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate to high confidence (70%), supported by evidence indicating ransomware attack with $60,000 demand; implies encryption and Inhibit System Recovery (T1490) with moderate confidence (50%), supported by evidence indicating ransomware attacks often disable recovery options. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.