Incident Score: Analysis & Impact (UNIPRE1766527872)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (50%), supported by evidence indicating attack vector and vulnerability exploited not specified and Supply Chain Compromise (T1195) with moderate confidence (60%), supported by evidence indicating supply chain such as true in incident metadata. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with lower confidence (40%), supported by evidence indicating ransomware attack implies malicious execution (implied). Under the Persistence tactic, the analysis identified Scheduled Task/Job: Scheduled Task (T1053.005) with lower confidence (30%), supported by evidence indicating ransomware often establishes persistence (implied). Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with lower confidence (40%), supported by evidence indicating ransomware typically escalates privileges (implied). Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate confidence (50%), supported by evidence indicating ransomware often uses obfuscation (implied) and Impair Defenses: Disable or Modify Tools (T1562.001) with lower confidence (40%), supported by evidence indicating ransomware may disable security tools (implied). Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with lower confidence (40%), supported by evidence indicating ransomware often dumps credentials (implied). Under the Discovery tactic, the analysis identified Account Discovery: Domain Account (T1087.002) with lower confidence (40%), supported by evidence indicating ransomware conducts discovery (implied). Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with lower confidence (30%), supported by evidence indicating ransomware may move laterally (implied). Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (70%), supported by evidence indicating 156 GB of stolen data posted on dark web. Under the Exfiltration tactic, the analysis identified Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating data posted on dark web (data exfiltration such as Yes) and Exfiltration Over C2 Channel (T1041) with moderate confidence (50%), supported by evidence indicating ransomware exfiltrates data via C2 (implied). Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate to high confidence (80%), supported by evidence indicating ransomware Attack with data encryption (implied) and Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating ransomware may destroy data (implied). These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.