Incident Score: Analysis & Impact (UNINAMIONGOD1770273279)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), with evidence including scanned WordPress sites for vulnerabilities, and wordPress vulnerabilities exploited and External Remote Services (T1133) with moderate to high confidence (70%), supported by evidence indicating sOCKS5 proxies enabled via compromised systems. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: Windows Command Shell (T1059.003) with moderate confidence (60%), supported by evidence indicating perl-based Linux variant deployed as payload and User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating droppers like SafeObject unpack to deploy 264 payloads. Under the Persistence tactic, the analysis identified Server Software Component: Web Shell (T1505.003) with moderate confidence (60%), supported by evidence indicating compromised systems remaining infected for over 100 days and Create or Modify System Process: Windows Service (T1543.003) with moderate confidence (50%), supported by evidence indicating systemBC converts systems into SOCKS5 proxies. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with high confidence (90%), with evidence including rC4-encrypted custom protocols, and perl variant evaded all 62 VirusTotal scanners, Hide Artifacts: Hidden Window (T1564.003) with moderate confidence (60%), supported by evidence indicating backconnect setup obscures malicious operations, and Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (70%), supported by evidence indicating sOCKS5 proxies used to obscure C2 traffic. Under the Command and Control tactic, the analysis identified Proxy: External Proxy (T1090.002) with high confidence (90%), supported by evidence indicating 10,340 unique infected IPs as SOCKS5 proxies, Encrypted Channel: Symmetric Cryptography (T1573.001) with moderate to high confidence (80%), supported by evidence indicating rC4-encrypted custom protocols for C2, and Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (70%), supported by evidence indicating c2 servers rely on bulletproof hosting providers. Under the Impact tactic, the analysis identified Network Denial of Service (T1498) with high confidence (90%), with evidence including dDoS attacks launched via botnet, and 10,340+ infected IPs for high-bandwidth attacks and Data Encrypted for Impact (T1486) with moderate confidence (60%), supported by evidence indicating malware functions as ransomware loader. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.