Incident Score: Analysis & Impact (SMASIMCONAMADAT1775551328)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (95%), with evidence including wave of phishing campaigns exploiting the U.S. tax season, and fake refund notices, payroll forms, and IRS impersonations, Phishing: Spearphishing Link (T1566.001) with high confidence (90%), with evidence including malicious links, QR codes, or attachments, and redirecting victims to fake Microsoft 365 sign-in pages, and Phishing: Spearphishing Attachment (T1566.002) with moderate to high confidence (80%), with evidence including malicious attachments, and fake tax-filing assistance links sent to accountants. Under the Execution tactic, the analysis identified User Execution: Malicious Link (T1204.001) with high confidence (90%), with evidence including trick recipients into interacting with malicious links, QR codes, and fake SmartVault site to download malicious ScreenConnect installer and User Execution: Malicious File (T1204.002) with moderate to high confidence (85%), with evidence including malicious attachments, and download a malicious ScreenConnect installer. Under the Credential Access tactic, the analysis identified Adversary-in-the-Middle (T1557) with high confidence (90%), with evidence including spoofed Microsoft 365 login pages, and harvest credentials, including two-factor authentication (2FA) codes and Brute Force: Password Guessing (T1110.001) with moderate confidence (50%), supported by evidence indicating phishing-as-a-Service (PhaaS) platforms like Energy365 and SneakyLog (Kratos). Under the Persistence tactic, the analysis identified External Remote Services (T1133) with high confidence (90%), supported by evidence indicating deploy remote monitoring and management (RMM) tools such as ConnectWise ScreenConnect, Datto, and SimpleHelp and Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (85%), with evidence including compromised Microsoft 365 accounts, and credentials (including 2FA codes) harvested. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), with evidence including fake SmartVault site (smartvault.im), and domains like irs-doc.com and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate to high confidence (70%), with evidence including abuse of trusted RMM tools to evade detection, and unauthorized usage can go unnoticed. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), with evidence including sensitive financial data compromised, and pII and Financial Data Exposure and Email Collection: Remote Email Collection (T1114.002) with moderate to high confidence (70%), supported by evidence indicating targeting accountants, tax professionals handling sensitive financial data. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), with evidence including 29,000 users across 10,000 organizations affected, and potential data exfiltration and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate confidence (60%), supported by evidence indicating abuse of trusted RMM tools for persistent access. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.