Incident Score: Analysis & Impact (NEW1772742770)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Spearphishing Attachment (T1566.001) with moderate to high confidence (80%), supported by evidence indicating seedworm employs social engineering including spear-phishing, Exploit Public-Facing Application (T1190) with moderate to high confidence (70%), supported by evidence indicating vulnerable cameras (CVE-2023-6895, CVE-2017-7921) exploited, and External Remote Services (T1133) with moderate confidence (60%), supported by evidence indicating backdoors (Dindoor, Fakeset) deployed via cloud storage. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: Python (T1059.006) with high confidence (90%), supported by evidence indicating fakeset such as A Python-based backdoor deployed and Command and Scripting Interpreter: JavaScript (T1059.007) with moderate to high confidence (80%), supported by evidence indicating dindoor such as A Deno-based backdoor (JavaScript runtime). Under the Persistence tactic, the analysis identified Create or Modify System Process: Windows Service (T1543.003) with moderate to high confidence (70%), supported by evidence indicating backdoors (Dindoor, Fakeset) likely establish persistence and Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001) with moderate confidence (60%), supported by evidence indicating custom malware historically used for persistence. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating password spraying attacks on Israeli municipal governments and Exploitation for Privilege Escalation (T1068) with moderate confidence (50%), supported by evidence indicating exploitation of known vulnerabilities (CVE-2023-6895). Under the Defense Evasion tactic, the analysis identified Subvert Trust Controls: Code Signing (T1553.002) with high confidence (90%), supported by evidence indicating backdoors signed with certificates for Amy Cherne and Donald Gay, Masquerading: Match Legitimate Name or Location (T1036.005) with moderate to high confidence (80%), supported by evidence indicating backdoors signed with legitimate-looking certificates, and Obfuscated Files or Information (T1027) with moderate to high confidence (70%), supported by evidence indicating custom malware (Dindoor, Fakeset) likely obfuscated. Under the Credential Access tactic, the analysis identified Brute Force: Password Spraying (T1110.003) with high confidence (90%), supported by evidence indicating password-spraying attacks on Israeli municipal governments and Adversary-in-the-Middle (T1557) with moderate confidence (60%), supported by evidence indicating spear-phishing and mailbox compromises for credential harvesting. Under the Discovery tactic, the analysis identified Account Discovery: Domain Account (T1087.002) with moderate to high confidence (70%), supported by evidence indicating aPT groups typically conduct account discovery post-access and Network Service Discovery (T1046) with moderate to high confidence (70%), supported by evidence indicating backdoors used for network reconnaissance. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating data exfiltration attempts using Rclone to Wasabi cloud storage and Data from Information Repositories (T1213) with moderate to high confidence (70%), supported by evidence indicating targeted defense, aerospace, and financial sectors for sensitive data. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (80%), supported by evidence indicating backdoors communicate via cloud storage (Backblaze, Wasabi) and Ingress Tool Transfer (T1105) with moderate to high confidence (70%), supported by evidence indicating fakeset downloaded from Backblaze cloud storage servers. Under the Exfiltration tactic, the analysis identified Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with high confidence (90%), supported by evidence indicating rclone used to exfiltrate data to Wasabi cloud storage bucket and Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating backdoors (Dindoor, Fakeset) facilitate data exfiltration. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate confidence (60%), supported by evidence indicating historical use of wipers (BibiWiper) by Iranian-aligned groups and Data Destruction (T1485) with moderate confidence (50%), supported by evidence indicating druidfly deployed wipers destroying master boot records (MBRs). These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.