Incident Score: Analysis & Impact (SANASA1777544986)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (50%), supported by evidence indicating breach includes documents spanning December 2016 to September 2025 and Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating qilin ransomware gang likely used compromised credentials. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating qilin ransomware operation has exposed nearly 12,000 files. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with moderate confidence (60%), supported by evidence indicating employee performance evaluations, 401K details, and salary records leaked. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating names, birthdates, phone numbers, home/email addresses compromised and Data from Information Repositories (T1213) with moderate to high confidence (70%), supported by evidence indicating nearly 12,000 files containing highly sensitive data exposed. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration such as Yes in ransomware section. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with moderate to high confidence (80%), supported by evidence indicating qilin ransomware gang responsible for the attack and Defacement: Internal Defacement (T1491.001) with moderate confidence (50%), supported by evidence indicating attack threatening the organization’s existence. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate confidence (60%), supported by evidence indicating qilin ransomware operation known for evasion tactics. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.