Incident Score: Analysis & Impact (QUEMAS1776133442)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), with evidence including gains access via compromised accounts, and attack vector such as Compromised accounts. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating deploys malicious files (e.g., win.exe). Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating escalates privileges after compromised accounts. Under the Credential Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating compromised accounts used for access. Under the Discovery tactic, the analysis identified File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating exfiltrated fault reports, internal building layouts, infrastructure photos. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating customer records, HR docs, financial data, infrastructure data compromised and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating data from Queensland Communications (acquired in 2013) also exposed. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration confirmed; published on darknet leak site. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate confidence (50%), supported by evidence indicating ransomware attack; no explicit encryption details and Defacement (T1491) with moderate to high confidence (70%), supported by evidence indicating data published on INC Ransom’s darknet leak site. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating compromised accounts used to evade detection. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.