Incident Score: Analysis & Impact (MED1772728377)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (60%), with evidence including patient portal used by public health organizations, and mediMap portal used by aged-care homes and Valid Accounts (T1078) with moderate to high confidence (70%), with evidence including unauthorized actors tampered with patient records, and accessed and exfiltrated medical records. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate confidence (50%), supported by evidence indicating ransomware attackers accessed and exfiltrated medical records. Under the Credential Access tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), with evidence including unauthorized actors tampered with patient records, and accessed and exfiltrated medical records. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating medical records of approximately 120,000 patients exfiltrated and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating patient portal used by public health organizations compromised. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), with evidence including ransomware attackers...exfiltrated medical records, and threatened to leak them on the dark web and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating threatened to leak them on the dark web. Under the Impact tactic, the analysis identified Data Destruction (T1485) with moderate to high confidence (70%), supported by evidence indicating unauthorized actors tampered with patient records, altering names, birthdates, Data Encrypted for Impact (T1486) with moderate confidence (50%), supported by evidence indicating ransomware attackers accessed and exfiltrated medical records, and Data Manipulation: Transmitted Data Manipulation (T1565.002) with high confidence (90%), with evidence including marking living patients as deceased, and altering names, birthdates. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating unauthorized actors tampered with patient records without detection and Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate confidence (50%), supported by evidence indicating ransomware attackers accessed and exfiltrated medical records. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.