Incident Score: Analysis & Impact (ORAJOOMANWPMDIGTHE1783693992)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), supported by evidence indicating exploited 27 known vulnerabilities, primarily in WordPress plugins and Exploitation of Remote Services (T1210) with moderate to high confidence (80%), supported by evidence indicating nacos configuration server flaw (CVE-2021-29441) exploited. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: Unix Shell (T1059.004) with high confidence (90%), supported by evidence indicating webshells (down.php, VShell) granting remote control over servers and Exploitation for Client Execution (T1203) with moderate to high confidence (80%), supported by evidence indicating breeze caching plugin (CVE-2026-3844) exploited to deploy webshells. Under the Persistence tactic, the analysis identified Server Software Component: Web Shell (T1505.003) with high confidence (95%), supported by evidence indicating 25,195+ sites with webshells (down.php, VShell) installed and Web Shell (T1100) with high confidence (90%), supported by evidence indicating webshells disguised as kernel processes (kworker/0 such as 2). Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate to high confidence (70%), supported by evidence indicating exploited vulnerabilities in plugins to gain remote control. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with moderate to high confidence (80%), supported by evidence indicating vShell backdoor disguised as kernel process (kworker/0 such as 2), Obfuscated Files or Information (T1027) with moderate to high confidence (85%), supported by evidence indicating down.php webshell heavily obfuscated (derived from BestShell), and Hide Artifacts: Hidden Window (T1564.003) with moderate to high confidence (70%), supported by evidence indicating webshells designed to evade detection. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (90%), supported by evidence indicating 613 configuration files extracted with cloud credentials (AWS, Alibaba, etc.) and Unsecured Credentials: Private Keys (T1552.004) with high confidence (90%), supported by evidence indicating alipay RSA private keys exposed. Under the Discovery tactic, the analysis identified Active Scanning: Vulnerability Scanning (T1595.002) with high confidence (90%), supported by evidence indicating fOFA search engine used to build target lists of 1.4 million sites and File and Directory Discovery (T1083) with moderate to high confidence (80%), supported by evidence indicating activity logs and scan results found on exposed server. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating 613 configuration files extracted from 11 corporate systems and Data from Information Repositories: Sharepoint (T1213.002) with moderate confidence (60%), supported by evidence indicating corporate systems targeted (fintech, e-commerce, logistics). Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with high confidence (90%), supported by evidence indicating webshells (down.php, VShell) used for remote control and Ingress Tool Transfer (T1105) with moderate to high confidence (80%), supported by evidence indicating hacking tools and exploit scripts found on exposed server. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating webshell access brokerage implies data sold on dark web and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating cloud credentials (AWS, Alibaba, etc.) extracted. Under the Impact tactic, the analysis identified Resource Hijacking (T1496) with moderate to high confidence (80%), supported by evidence indicating webshells installed for resale of access to other criminals. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.