Incident Score: Analysis & Impact (RED1782988216)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Voice (T1566.004) with high confidence (90%), supported by evidence indicating hackers posed as employees to trick the company’s IT helpdesk into resetting credentials, Trusted Relationship (T1199) with moderate to high confidence (80%), supported by evidence indicating social engineering scheme targeting IT helpdesk to gain access to administrator accounts, and Multi-Factor Authentication Request Generation (T1621) with high confidence (90%), supported by evidence indicating mFA bombing (MFA fatigue) used to steal credentials. Under the Execution tactic, the analysis identified User Execution: Malicious Link (T1204.001) with moderate to high confidence (70%), supported by evidence indicating sMS phishing used to trick users into executing malicious actions. Under the Credential Access tactic, the analysis identified Brute Force: Password Cracking (T1110.002) with moderate to high confidence (80%), supported by evidence indicating mFA fatigue attacks to bypass authentication and Modify Authentication Process: Multi-Factor Authentication (T1556.006) with moderate to high confidence (70%), supported by evidence indicating mFA bombing used to exploit authentication processes. Under the Privilege Escalation tactic, the analysis identified Valid Accounts: Domain Accounts (T1078.002) with high confidence (90%), supported by evidence indicating gained access to administrator accounts via social engineering. Under the Defense Evasion tactic, the analysis identified Use Alternate Authentication Material: Web Session Cookie (T1550.004) with moderate to high confidence (70%), supported by evidence indicating likely use of stolen session cookies post-credential access and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (80%), supported by evidence indicating compromised administrator accounts used to evade defenses. Under the Discovery tactic, the analysis identified Account Discovery: Domain Account (T1087.002) with moderate to high confidence (70%), supported by evidence indicating likely discovery of high-value accounts post-initial access. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating 100GB of data claimed to be stolen from victim systems. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration confirmed (100GB claimed stolen). Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating dragonForce encryptor deployed in attacks and Defacement: Internal Defacement (T1491.001) with moderate confidence (60%), supported by evidence indicating disruptive impact on critical operations across industries. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.