Incident Score: Analysis & Impact (N8NNPM1768244856)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise: Compromise Software Dependencies and Development Tools (T1195.001) with high confidence (95%), with evidence including malicious npm packages designed to impersonate integrations for n8n, and eight malicious npm packages uploaded to target n8n and User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating tricking users into linking their accounts via a seemingly legitimate form. Under the Execution tactic, the analysis identified Command and Scripting Interpreter (T1059) with moderate to high confidence (70%), supported by evidence indicating malicious packages decrypted stored OAuth tokens using n8n’s master key and User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating malicious npm packages executed during workflow automation. Under the Credential Access tactic, the analysis identified Steal Application Access Token (T1528) with high confidence (95%), with evidence including steal developers OAuth credentials, and exfiltrating credentials to attacker-controlled servers and Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (90%), supported by evidence indicating decrypted stored OAuth tokens using n8n’s master key. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating access environment variables, file systems, and decrypted credentials. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (95%), supported by evidence indicating transmitted them to external servers during workflow execution. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), supported by evidence indicating malicious npm packages designed to impersonate integrations for n8n and Subvert Trust Controls: Code Signing (T1553.002) with moderate to high confidence (70%), supported by evidence indicating trust in community-driven integrations exploited. Under the Lateral Movement tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating oAuth tokens for Google Ads, Stripe, and Salesforce stolen. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.