Incident Score: Analysis & Impact (SMASIMCONAMADAT1775551328)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (95%), with evidence including wave of phishing campaigns exploiting the U.S. tax season, and fake refund notices, payroll forms, and IRS impersonations, Phishing: Spearphishing Link (T1566.001) with high confidence (90%), with evidence including malicious links, QR codes, or attachments, and redirecting victims to fake Microsoft 365 sign-in pages, and Phishing: Spearphishing Attachment (T1566.002) with moderate to high confidence (80%), with evidence including malicious attachments, and fake tax-filing assistance links. Under the Execution tactic, the analysis identified User Execution: Malicious Link (T1204.001) with high confidence (90%), supported by evidence indicating trick recipients into interacting with malicious links, QR codes and User Execution: Malicious File (T1204.002) with moderate to high confidence (85%), with evidence including malicious attachments, and download a malicious ScreenConnect installer. Under the Credential Access tactic, the analysis identified Modify Authentication Process: Multi-Factor Authentication (T1556.006) with moderate to high confidence (80%), supported by evidence indicating harvest credentials, including two-factor authentication (2FA) codes, Input Capture: Keylogging (T1056.001) with moderate to high confidence (70%), supported by evidence indicating spoofed Microsoft 365 login pages to harvest credentials, and Brute Force: Password Guessing (T1110.001) with moderate confidence (60%), supported by evidence indicating phishing-as-a-Service (PhaaS) platforms like Energy365 and SneakyLog. Under the Persistence tactic, the analysis identified External Remote Services (T1133) with high confidence (90%), supported by evidence indicating deploy remote monitoring and management (RMM) tools such as ConnectWise ScreenConnect and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (85%), with evidence including compromised Microsoft 365 accounts, and persistent access to compromised systems. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), with evidence including fake SmartVault site (smartvault.im), and iRS impersonation with domains like irs-doc.com, Subvert Trust Controls: Code Signing (T1553.002) with moderate to high confidence (70%), supported by evidence indicating abuse of trusted RMM tools to evade detection, and Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating unauthorized usage of RMM tools can go unnoticed. Under the Command and Control tactic, the analysis identified Remote Access Software (T1219) with high confidence (95%), supported by evidence indicating deploy RMM tools (ScreenConnect, Datto, SimpleHelp) for persistent access and Proxy: External Proxy (T1090.002) with moderate to high confidence (70%), supported by evidence indicating daisy-chaining multiple tools to evade detection. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), with evidence including potential data exfiltration, and 29,000 users across 10,000 organizations affected and Transfer Data to Cloud Account (T1537) with moderate to high confidence (70%), supported by evidence indicating credentials and sensitive financial data compromised. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.