Incident Score: Analysis & Impact (ROC1780072449)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (50%), supported by evidence indicating unusual activity on orchestra’s servers prompted investigation and Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating unauthorized access to parts of the network confirmed. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating ransomware attack by the cybercriminal group Akira. Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with moderate confidence (60%), supported by evidence indicating social Security numbers, driver’s license numbers compromised. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating sensitive personal data...compromised via orchestra’s servers and Data from Information Repositories (T1213) with moderate to high confidence (70%), supported by evidence indicating medical records, health insurance details exposed. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating akira posted details of the breach on the dark web and Transfer Data to Cloud Account (T1537) with moderate confidence (50%), supported by evidence indicating data breach affecting 1,726 individuals. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating ransomware attack by Akira. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate confidence (60%), supported by evidence indicating unusual activity detected only after investigation and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (50%), supported by evidence indicating independent cybersecurity experts involved post-detection. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.