Incident Score: Analysis & Impact (WESSHARAMSHA1787891249)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) with high confidence (90%), with evidence including third-party IT provider was compromised, and supply chain attacks, where cybercriminals exploit vulnerabilities in third-party vendors. Under the Credential Access tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating login credentials included in stolen data samples and Unsecured Credentials: Credentials In Files (T1552.001) with moderate to high confidence (70%), supported by evidence indicating login credentials included in stolen data samples. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating employee passport and driver’s license scans, financial records, customer invoices compromised and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating financial records, customer invoices compromised via third-party IT provider. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), with evidence including storm ransomware group has released samples of stolen data, and threatened to publish the entire dataset. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate to high confidence (70%), with evidence including type such as Ransomware, and storm ransomware group listed victim on leak site and Defacement: External Defacement (T1491.002) with moderate confidence (60%), supported by evidence indicating storm ransomware group listed victim on leak site with data samples. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating compromised third-party IT provider likely used valid accounts and Hide Artifacts: Hidden Window (T1564.003) with moderate confidence (50%), supported by evidence indicating ransomware operation avoids detection during initial access. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.