Incident Score: Analysis & Impact (LG-KT-1785457450)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating attackers obtained a valid authentication certificate from the lost device and Hardware Additions (T1200) with moderate to high confidence (80%), supported by evidence indicating installed it on a rogue femtocell, tricking nearby devices into connecting. Under the Persistence tactic, the analysis identified Account Manipulation (T1098) with moderate to high confidence (70%), supported by evidence indicating femtocell certificates remained valid for 10 years without renewal and BITS Jobs (T1197) with moderate confidence (50%), supported by evidence indicating bPFDoor malware enabled attackers to monitor network traffic covertly. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate to high confidence (70%), supported by evidence indicating bypass route allowed attackers to evade the femtocell management server. Under the Defense Evasion tactic, the analysis identified Impair Defenses: Disable or Modify Tools (T1562.001) with moderate to high confidence (80%), supported by evidence indicating kT failed to report BPFDoor malware infection and deleted logs and Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating valid authentication certificate from the lost device. Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle (T1557) with high confidence (90%), supported by evidence indicating intercept mobile traffic, including phone numbers, IMSI, IMEI, SMS/ARS codes and Brute Force: Password Guessing (T1110.001) with moderate confidence (60%), supported by evidence indicating capture SMS and ARS authentication codes used for micropayments. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating exposure of 16,647 subscribers’ personal data, including phone numbers, IMSI, IMEI and Automated Collection (T1119) with moderate to high confidence (80%), supported by evidence indicating bPFDoor malware enabled attackers to monitor network traffic covertly. Under the Command and Control tactic, the analysis identified Proxy: External Proxy (T1090.002) with moderate to high confidence (70%), supported by evidence indicating rogue femtocell tricked nearby devices into connecting and Application Layer Protocol: Web Protocols (T1071.001) with moderate confidence (60%), supported by evidence indicating bPFDoor malware linked to China-nexus Red Menshen group. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating fraudulent micropayments totaling KRW 240 million ($167,400) and Exfiltration Over Alternative Protocol: Unencrypted/Obfuscated Non-C2 Protocol (T1048.003) with moderate to high confidence (70%), supported by evidence indicating intercept mobile traffic, including SMS/ARS authentication codes. Under the Impact tactic, the analysis identified Defacement: Internal Defacement (T1491.001) with moderate confidence (60%), supported by evidence indicating fraudulent micropayments for 368 victims and Financial Theft (T1657) with high confidence (90%), supported by evidence indicating kRW 240 million ($167,400) in fraudulent mobile payments. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.