Incident Score: Analysis & Impact (RELLEX1772562253)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), supported by evidence indicating exploited the React2Shell vulnerability in an unpatched React frontend application. Under the Execution tactic, the analysis identified Container Administration Command (T1609) with moderate to high confidence (80%), supported by evidence indicating gained access via the compromised LawfirmsStoreECSTaskRole ECS task container. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating rDS master password was set to Lexis1234 and Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002) with moderate to high confidence (70%), supported by evidence indicating single task role had access to all AWS Secrets Manager entries. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (90%), supported by evidence indicating 53 plaintext AWS Secrets Manager secrets exposed and Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating rDS master password was set to Lexis1234. Under the Discovery tactic, the analysis identified Account Discovery: Cloud Account (T1087.004) with moderate to high confidence (80%), supported by evidence indicating 400,000 cloud user profiles (names, emails, phone numbers, job functions) exposed and Cloud Infrastructure Discovery (T1580) with moderate to high confidence (80%), supported by evidence indicating complete VPC infrastructure map exposed. Under the Collection tactic, the analysis identified Data from Cloud Storage Object (T1530) with high confidence (90%), supported by evidence indicating 3.9 million database records, 2.04 GB of structured data stolen from AWS cloud and Data from Information Repositories: Code Repositories (T1213.003) with moderate to high confidence (70%), supported by evidence indicating aWS Secrets Manager secrets exposed. Under the Exfiltration tactic, the analysis identified Transfer Data to Cloud Account (T1537) with moderate to high confidence (80%), supported by evidence indicating 2.04 GB of data stolen from AWS cloud infrastructure and Exfiltration Over C2 Channel (T1041) with moderate to high confidence (70%), supported by evidence indicating threat actor FulcrumSec publicly took responsibility for the breach. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (40%), supported by evidence indicating 2.04 GB of structured data stolen, potential for misuse and Account Access Removal (T1531) with lower confidence (30%), supported by evidence indicating 45 employee password hashes exposed. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.