Incident Score: Analysis & Impact (NETEGN1780907044)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), with evidence including compromised a pfSense firewall, and targeting edge devices with limited security monitoring and Valid Accounts (T1078) with high confidence (95%), with evidence including leveraged valid credentials, and stolen administrative credentials. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating deployed a FreeBSD variant of the BRICKSTORM backdoor and Command and Scripting Interpreter: Unix Shell (T1059.004) with moderate to high confidence (70%), supported by evidence indicating modifying /etc/rc.d/cron to execute the implant automatically. Under the Persistence tactic, the analysis identified Create or Modify System Process: Systemd Service (T1543.002) with moderate to high confidence (80%), supported by evidence indicating modifying /etc/rc.d/cron to execute the implant automatically and Server Software Component: Web Shell (T1505.003) with moderate to high confidence (70%), supported by evidence indicating bRICKSTORM supports file system access via a web interface. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), with evidence including stolen administrative credentials, and enabled web SSL VPN access on the firewall. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating blending into normal traffic and bypassing Conditional Access rules, Masquerading: Match Legitimate Name or Location (T1036.005) with moderate to high confidence (80%), supported by evidence indicating bRICKSTORM implant named *blocklist* in /usr/local/libexec/ipsec/, and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating edge devices with limited security monitoring. Under the Credential Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (95%), with evidence including stolen administrative credentials, and valid credentials. Under the Discovery tactic, the analysis identified Account Discovery: Domain Account (T1087.002) with moderate to high confidence (70%), supported by evidence indicating access the victim’s Microsoft 365 environment and Network Service Discovery (T1046) with moderate to high confidence (70%), supported by evidence indicating lateral movement and traffic obfuscation. Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with moderate to high confidence (70%), supported by evidence indicating enabled web SSL VPN access on the firewall, Proxy: External Proxy (T1090.002) with moderate to high confidence (80%), with evidence including sOCKS5 proxying, and malware proxy features, and Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating stolen administrative credentials. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), with evidence including data exfiltration, and access to a managed service provider’s network. Under the Command and Control tactic, the analysis identified Proxy: External Proxy (T1090.002) with high confidence (90%), with evidence including sOCKS5 proxying, and communicating with attacker-controlled infrastructure, Ingress Tool Transfer (T1105) with moderate to high confidence (80%), supported by evidence indicating deployed additional malware on a Synology NAS device, and Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (70%), supported by evidence indicating bRICKSTORM supports file system access via a web interface. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), with evidence including data exfiltration, and communicating with attacker-controlled infrastructure and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating access to Microsoft 365 environment. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (70%), supported by evidence indicating persistent unauthorized access, lateral movement. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.