Incident Score: Analysis & Impact (NOK1787826928)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), supported by evidence indicating qScan to scan and exploit vulnerable IoT devices at scale and Exploitation of Remote Services (T1210) with moderate to high confidence (70%), supported by evidence indicating compromised devices were then enrolled in QTRouter. Under the Persistence tactic, the analysis identified Account Manipulation (T1098) with moderate confidence (60%), supported by evidence indicating enrolled in QTRouter, a network of hijacked IoT hardware and Server Software Component: Web Shell (T1505.003) with moderate confidence (50%), supported by evidence indicating infrastructure-as-a-service model using QScan and QTRouter. Under the Defense Evasion tactic, the analysis identified Proxy (T1090) with high confidence (90%), supported by evidence indicating qTRouter masked malicious traffic by routing through legitimate systems, Masquerading (T1036) with moderate to high confidence (80%), supported by evidence indicating traffic traced to local IP addresses or consumer devices, and Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate confidence (60%), supported by evidence indicating hard-coded domains in malware rendered inoperable after seizure. Under the Command and Control tactic, the analysis identified Proxy: Multi-hop Proxy (T1090.003) with high confidence (90%), supported by evidence indicating proxy services and virtual private servers outside China and Ingress Tool Transfer (T1105) with moderate to high confidence (70%), supported by evidence indicating qScan and QTRouter platforms used for malicious operations. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating cyber espionage targeting U.S. critical infrastructure and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating proxy-based architecture for masking malicious traffic. Under the Reconnaissance tactic, the analysis identified Active Scanning (T1595) with high confidence (90%), supported by evidence indicating qScan used to scan and exploit vulnerable IoT devices and Gather Victim Network Information (T1590) with moderate to high confidence (70%), supported by evidence indicating high-profile U.S. targets compromised. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.