Incident Score: Analysis & Impact (SNA1767973005)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), with evidence including orchestrating a phishing operation, and trick targets into sharing access codes and Phishing: Spearphishing via Service (T1566.003) with moderate to high confidence (80%), supported by evidence indicating impersonated Snapchat representatives to trick targets. Under the Execution tactic, the analysis identified User Execution (T1204) with moderate to high confidence (70%), with evidence including victims sharing access codes, and human error (victims sharing access codes). Under the Credential Access tactic, the analysis identified Unsecured Credentials (T1552) with moderate to high confidence (80%), supported by evidence indicating obtain victims emails, phone numbers, and usernames and Brute Force (T1110) with moderate confidence (50%), supported by evidence indicating accessed at least 59 accounts without authorization. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), with evidence including download private images, and private photos, personal information compromised. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating data exfiltration such as Yes (stolen content sold or traded online) and Exfiltration Over Web Service (T1567) with moderate to high confidence (70%), supported by evidence indicating advertised his hacking services on platforms like Reddit. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with lower confidence (30%), supported by evidence indicating no evidence of encryption, but private content was stolen and Data Manipulation (T1565) with lower confidence (40%), supported by evidence indicating stolen content sold or traded online (potential misuse). Under the Defense Evasion tactic, the analysis identified Modify Authentication Process (T1556) with moderate confidence (60%), supported by evidence indicating impersonated Snapchat representatives to gain access and Masquerading (T1036) with moderate to high confidence (70%), supported by evidence indicating impersonated Snap representatives to trick targets. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.