Incident Score: Analysis & Impact (SSLNATOR-1780945453)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), supported by evidence indicating tricked into entering credentials on a fake Office 365 login page, Exploit Public-Facing Application (T1190) with moderate to high confidence (70%), supported by evidence indicating third-party mail service provider breach (NBA), and Trusted Relationship (T1199) with moderate to high confidence (80%), supported by evidence indicating third-party vulnerabilities exploited in multiple incidents. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating olympic Destroyer malware disabled Wi-Fi, telecasts, and ticketing and Command and Scripting Interpreter (T1059) with moderate to high confidence (70%), supported by evidence indicating malware spread across connected networks (2018 Olympics). Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating credentials stolen via fake Office 365 login pages. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating stolen credentials used to access sensitive systems. Under the Defense Evasion tactic, the analysis identified Indicator Removal: File Deletion (T1070.004) with moderate to high confidence (80%), supported by evidence indicating olympic Destroyer malware wiped data and stole passwords and Masquerading (T1036) with moderate to high confidence (70%), supported by evidence indicating fake Office 365 login pages used in BEC scams. Under the Credential Access tactic, the analysis identified Credentials from Password Stores (T1555) with moderate to high confidence (80%), supported by evidence indicating olympic Destroyer malware stole passwords and Brute Force (T1110) with moderate confidence (60%), supported by evidence indicating credential theft via phishing and malware. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (70%), supported by evidence indicating data exfiltration included player contracts, medical records. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating 500 GB of data stolen (Houston Rockets), 32 GB (ASVEL) and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating player contracts, financial records, medical records compromised. Under the Command and Control tactic, the analysis identified Application Layer Protocol (T1071) with moderate to high confidence (70%), supported by evidence indicating malware spread across connected networks (2018 Olympics). Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating 500 GB of data exfiltrated (Houston Rockets) and Exfiltration Over Web Service (T1567) with moderate to high confidence (70%), supported by evidence indicating data exfiltration via ransomware attacks (ASVEL, KNVB). Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating ransomware attacks encrypted data (Manchester United, ASVEL), Data Destruction (T1485) with moderate to high confidence (80%), supported by evidence indicating olympic Destroyer malware wiped data, and Defacement (T1491) with moderate to high confidence (70%), supported by evidence indicating boca Juniors YouTube channel hijacked for cryptocurrency scam. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.