Incident Score: Analysis & Impact (LONFIFMIL1775600913)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (60%), with evidence including attack surface for adversaries seeking disruption, and third-party vendors expand attack surface, Phishing (T1566) with moderate to high confidence (80%), supported by evidence indicating prepare for phishing...credential harvesting, and Supply Chain Compromise (T1195) with moderate to high confidence (70%), supported by evidence indicating third-Party Risks such as vendors, sponsors, streaming services. Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with moderate confidence (50%), supported by evidence indicating olympic Destroyer malware disrupted Wi-Fi, ticketing and User Execution: Malicious File (T1204.002) with moderate confidence (60%), supported by evidence indicating malware...disrupted Wi-Fi, ticketing, broadcast systems. Under the Persistence tactic, the analysis identified External Remote Services (T1133) with moderate confidence (50%), supported by evidence indicating wi-Fi and broadcast systems targeted. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating credential harvesting...mirror threats faced. Under the Defense Evasion tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with moderate confidence (50%), supported by evidence indicating streaming services...expand attack surface and Endpoint Denial of Service (T1499) with high confidence (90%), supported by evidence indicating 180% spike in DDoS attacks during Winter Games. Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle (T1557) with moderate to high confidence (70%), supported by evidence indicating credential harvesting...prepare for and Brute Force (T1110) with moderate confidence (50%), supported by evidence indicating high-profile attendees face device compromise. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate confidence (60%), supported by evidence indicating executive targeting for identity theft. Under the Lateral Movement tactic, the analysis identified Exploitation of Remote Services (T1210) with moderate confidence (50%), supported by evidence indicating wi-Fi and broadcast systems targeted. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate confidence (60%), supported by evidence indicating ransomware...mirror threats faced, Defacement (T1491) with moderate confidence (50%), supported by evidence indicating hacktivism driven by geopolitical tensions, and Data Manipulation: Stored Data Manipulation (T1565.001) with lower confidence (40%), supported by evidence indicating disruption of ticketing and broadcast systems. Under the Command and Control tactic, the analysis identified Application Layer Protocol (T1071) with moderate confidence (50%), supported by evidence indicating dDoS attacks...180% spike. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.