Incident Score: Analysis & Impact (GNVMSC1765979891)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Hardware Additions (T1200) with high confidence (95%), with evidence including raspberry Pi device connected to shipboard system, and second device paired with cellular modem for remote access and Supply Chain Compromise: Compromise Hardware (T1195.003) with moderate to high confidence (80%), supported by evidence indicating concealed miniature computer (Raspberry Pi) discovered in restricted area. Under the Persistence tactic, the analysis identified Account Manipulation (T1098) with moderate to high confidence (70%), supported by evidence indicating attack aimed to impersonate legitimate users on office computer network and External Remote Services (T1133) with moderate to high confidence (85%), supported by evidence indicating cellular modem paired with Raspberry Pi for remote access. Under the Credential Access tactic, the analysis identified Brute Force (T1110) with moderate confidence (60%), supported by evidence indicating attempt to impersonate legitimate users (implies credential compromise). Under the Lateral Movement tactic, the analysis identified Exploitation of Remote Services (T1210) with moderate to high confidence (70%), supported by evidence indicating targeted office network to potentially move to operational systems. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (75%), supported by evidence indicating suspected long-term surveillance motive for espionage. Under the Command and Control tactic, the analysis identified Ingress Tool Transfer (T1105) with moderate to high confidence (80%), supported by evidence indicating cellular modem on Raspberry Pi suggests remote command/control. Under the Defense Evasion tactic, the analysis identified Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate to high confidence (85%), supported by evidence indicating concealed Raspberry Pi device in restricted area and Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating attempt to impersonate legitimate users on office network. Under the Reconnaissance tactic, the analysis identified Active Scanning (T1595) with moderate confidence (60%), supported by evidence indicating previous discovery of Raspberry Pi in November suggests reconnaissance. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.