Incident Score: Analysis & Impact (VISRUPCOS1780793686)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (60%), supported by evidence indicating compromised the bank’s ATM switch server via malware and Exploitation for Client Execution (T1203) with moderate to high confidence (70%), supported by evidence indicating malware compromise of ATM switch server. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating malware...stealing data linked to VISA and RuPay debit cards. Under the Persistence tactic, the analysis identified Server Software Component: Web Shell (T1505.003) with moderate confidence (50%), supported by evidence indicating aTM switch server compromise via malware. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate confidence (60%), supported by evidence indicating sWIFT system exploitation to transfer funds. Under the Defense Evasion tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating cloned debit cards used for withdrawals in 28 countries and Masquerading (T1036) with moderate to high confidence (70%), supported by evidence indicating fraudulent transactions executed using cloned cards. Under the Credential Access tactic, the analysis identified Input Capture: Web Portal Capture (T1056.003) with moderate confidence (60%), supported by evidence indicating aTM switch server compromise via malware and Brute Force: Password Cracking (T1110.002) with moderate confidence (50%), supported by evidence indicating cloned debit cards used for unauthorized access. Under the Discovery tactic, the analysis identified Account Discovery: Domain Account (T1087.002) with moderate confidence (60%), supported by evidence indicating high-value targets such as VISA and RuPay debit card data. Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with moderate confidence (50%), supported by evidence indicating sWIFT system exploitation for fund transfer. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating vISA and RuPay debit card data compromised. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate confidence (60%), supported by evidence indicating fraudulent transactions across 28 countries. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating ₹94.42 crore stolen via ATM and SWIFT transactions and Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (T1048.003) with moderate to high confidence (70%), supported by evidence indicating funds transferred to Hong Kong-based bank via SWIFT. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with lower confidence (40%), supported by evidence indicating malware compromise of ATM switch server and Financial Theft (T1657) with high confidence (90%), supported by evidence indicating ₹94.42 crore stolen in coordinated attack. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.