Incident Score: Analysis & Impact (SNA1784903395)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.002) with high confidence (90%), supported by evidence indicating triggered password-recovery requests, posing as a Snap representative and Valid Accounts: Cloud Accounts (T1078.004) with high confidence (90%), supported by evidence indicating 570 women provided their access codes, granting unauthorized entry to 595 accounts. Under the Execution tactic, the analysis identified User Execution: Malicious Link (T1204.001) with moderate to high confidence (80%), supported by evidence indicating social engineering campaign...prompting Snap Inc. to send legitimate security codes. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Private Keys (T1552.004) with high confidence (90%), supported by evidence indicating victims’ email addresses, phone numbers, and Snapchat usernames collected and Forge Web Credentials: SAML Tokens (T1606.002) with moderate to high confidence (70%), supported by evidence indicating exploiting human trust in SMS-based password-recovery requests. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating downloaded nude or semi-nude images from compromised accounts and Data from Information Repositories: Sharepoint (T1213.002) with moderate confidence (60%), supported by evidence indicating private images retained, sold, or traded on internet forums. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating private images sold/traded on internet forums and private platforms. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating no evidence of data destruction, but images were distributed and Disk Wipe: Disk Structure Wipe (T1561.002) with lower confidence (10%), supported by evidence indicating no evidence of disk wiping. Under the Defense Evasion tactic, the analysis identified Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate to high confidence (70%), supported by evidence indicating used anonymized phone numbers to pose as a Snap representative and Masquerading: Masquerade Task or Service (T1036.004) with moderate to high confidence (80%), supported by evidence indicating posing as a Snap representative to request security codes. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.