Incident Score: Analysis & Impact (QIH1770215688)
The details regarding individual company incidents & reports gives you full view from every side.
Rankiteo Score Impact Analysis
Key Highlights From The Incident Analysis
- Timeline of Qihoo 360's Cyber Attack and lateral movement inside company's environment.
- Overview of affected data sets, including SSNs and PHI, and why they materially increase incident severity.
- How Rankiteo’s incident engine converts technical details into a normalized incident score.
- How this cyber incident impacts Qihoo 360 Rankiteo cyber scoring and cyber rating.
- Rankiteo’s MITRE ATT&CK correlation analysis for this incident, with associated confidence level.
Full Incident Analysis Transcript
In this Rankiteo incident briefing, we review the Qihoo 360 breach identified under incident ID QIH1770215688.
The analysis begins with a detailed overview of Qihoo 360's information like the linkedin page: https://www.linkedin.com/company/qihoo-360, the number of followers: 21877, the industry type: Technology, Information and Internet and the number of employees: 3034 employees
After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 776 and after the incident was 745 with a difference of -31 which is could be a good indicator of the severity and impact of the incident.
In the next step of the video, we will analyze in more details the incident and the impact it had on Qihoo 360 and their customers.
A newly reported cybersecurity incident, "Sophisticated ValleyRAT Campaign Targets Chinese-Speaking Users via Fake LINE Installer", has drawn attention.
A newly uncovered malware campaign is distributing the ValleyRAT backdoor disguised as a legitimate installer for LINE, the popular messaging app.
The disruption is felt across the environment, affecting Compromised systems with ValleyRAT backdoor, and exposing Login credentials.
Formal response steps have not been shared publicly yet.
The case underscores how Discovered, teams are taking away lessons such as Importance of verifying software sources and monitoring for suspicious process behavior, such as unexpected child processes spawned by Explorer.exe, and recommending next steps like Verify software sources, monitor for suspicious process behavior, and enhance endpoint detection and response (EDR) capabilities.
Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.
The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.
MITRE ATT&CK® Correlation Analysis
Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (80%), supported by evidence indicating distributing the ValleyRAT backdoor disguised as a legitimate installer for LINE and User Execution: Malicious File (T1204.002) with high confidence (90%), supported by evidence indicating fake installer that disables Windows Defender via PowerShell commands. Under the Execution tactic, the analysis identified Command and Scripting Interpreter: PowerShell (T1059.001) with high confidence (90%), supported by evidence indicating disables Windows Defender via PowerShell commands and User Execution: Malicious File (T1204.002) with high confidence (90%), supported by evidence indicating fake installer...deploys intel.dll, a malicious library. Under the Defense Evasion tactic, the analysis identified Impair Defenses: Disable or Modify Tools (T1562.001) with high confidence (95%), supported by evidence indicating disables Windows Defender via PowerShell commands, excluding entire drives, Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), supported by evidence indicating disguised as a legitimate installer for LINE, Obfuscated Files or Information (T1027) with moderate to high confidence (80%), supported by evidence indicating multi-stage infection chain to evade detection, Virtualization/Sandbox Evasion (T1497) with moderate to high confidence (85%), supported by evidence indicating performs sandbox checks including file locking and mutex creation, Subvert Trust Controls: Code Signing (T1553.002) with moderate to high confidence (80%), supported by evidence indicating fraudulent digital certificate issued to Chengdu MODIFENGNIAO Network Technology, and Impair Defenses: Disable or Modify System Firewall (T1562.004) with moderate to high confidence (70%), supported by evidence indicating terminates security software from vendors like Qihoo 360. Under the Persistence tactic, the analysis identified Scheduled Task/Job: Scheduled Task (T1053.005) with high confidence (90%), supported by evidence indicating registers scheduled tasks via Remote Procedure Call (RPC). Under the Privilege Escalation tactic, the analysis identified Process Injection: Process Hollowing (T1055.012) with moderate to high confidence (85%), supported by evidence indicating poolParty Variant 7 injection technique...hiding within Explorer.exe and Process Injection (T1055) with high confidence (90%), supported by evidence indicating injects code into legitimate processes like Explorer.exe and UserAccountBroker.exe. Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with moderate to high confidence (80%), supported by evidence indicating steal login credentials and establish long-term surveillance. Under the Discovery tactic, the analysis identified File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating sandbox checks including file locking and mutex creation. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (80%), supported by evidence indicating persistent communication with command-and-control (C2) servers. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating potential data exfiltration...persistent communication with C2 servers. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.
Sources & References
- Qihoo 360 Rankiteo Cyber Incident Details: https://www.rankiteo.com/company/qihoo-360/incident/QIH1770215688
- Qihoo 360 CyberSecurity Rating page: https://www.rankiteo.com/company/qihoo-360
- Qihoo 360 Rankiteo Cyber Incident Blog Article: https://blog.rankiteo.com/qih1770215688-qihoo-360-cyber-attack-february-2026/
- Qihoo 360 CyberSecurity Score History: https://www.rankiteo.com/company/qihoo-360/history
- Qihoo 360 CyberSecurity Incident Source: https://cybersecuritynews.com/valleyrat-mimic-as-line-installer-attacking-users/
- Rankiteo A.I CyberSecurity Rating methodology: https://www.rankiteo.com/Images/rankiteo_algo.pdf
- Rankiteo TPRM Scoring methodology: https://static.rankiteo.com/model/rankiteo_tprm_methodology.pdf