Incident Score: Analysis & Impact (RELLEX1772562253)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), supported by evidence indicating exploited the React2Shell vulnerability in an unpatched React frontend application. Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with moderate to high confidence (80%), supported by evidence indicating react2Shell vulnerability in React frontend application exploited. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating lawfirmsStoreECSTaskRole ECS task container had broad permissions. Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating eCS task container had access to all AWS Secrets Manager entries and Exploitation for Privilege Escalation (T1068) with moderate to high confidence (70%), supported by evidence indicating over-permissive ECS task role exploited for broad access. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating used compromised ECS task role to evade detection and Subvert Trust Controls (T1553) with moderate confidence (60%), supported by evidence indicating rDS master password set to Lexis1234. Under the Credential Access tactic, the analysis identified Cloud Instance Metadata API (T1552.005) with high confidence (90%), supported by evidence indicating eCS task container had access to AWS Secrets Manager, Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating single task role accessed all AWS Secrets Manager entries, and Password Cracking (T1110.002) with moderate to high confidence (70%), supported by evidence indicating 45 employee password hashes exposed. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (80%), supported by evidence indicating 400,000 cloud user profiles (names, emails, phone numbers) exposed and Network Service Discovery (T1046) with moderate to high confidence (70%), supported by evidence indicating complete VPC infrastructure map exposed. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating 3.9 million database records, 2.04 GB of data stolen from AWS and Data from Information Repositories (T1213) with high confidence (90%), supported by evidence indicating production Redshift data warehouse and 17 VPC databases accessed. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating 2.04 GB of structured data stolen by FulcrumSec and Transfer Data to Cloud Account (T1537) with moderate confidence (60%), supported by evidence indicating data exfiltrated from AWS cloud infrastructure. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating no evidence of data destruction, but high-volume exfiltration and Stored Data Manipulation (T1565.001) with lower confidence (40%), supported by evidence indicating potential for data manipulation given broad access to databases. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.