Incident Score: Analysis & Impact (SNA1786559100)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.001) with moderate to high confidence (80%), supported by evidence indicating fake login pages mimicking legitimate platforms have also been used, Phishing: Spearphishing Attachment (T1566.002) with moderate confidence (60%), supported by evidence indicating impersonate social media support teams, tricking victims into resetting passwords, Brute Force: Password Guessing (T1110.001) with moderate to high confidence (70%), supported by evidence indicating hackers employ...brute-force attacks to compromise accounts, and Valid Accounts: Cloud Accounts (T1078.004) with high confidence (90%), supported by evidence indicating using leaked passwords or personal details like birthdays to gain access. Under the Credential Access tactic, the analysis identified Credentials from Password Stores: Credentials from Web Browsers (T1555.003) with moderate to high confidence (70%), supported by evidence indicating leaked passwords or personal details like birthdays to gain access, Brute Force: Password Guessing (T1110.001) with moderate to high confidence (70%), supported by evidence indicating hackers employ...brute-force attacks to compromise accounts, and Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001) with moderate confidence (50%), supported by evidence indicating fake login pages mimicking legitimate platforms have also been used. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating steal explicit content and sell it on underground marketplaces and Data from Information Repositories: Sharepoint (T1213.002) with moderate confidence (60%), supported by evidence indicating access victims’ social media accounts (e.g., student athlete databases). Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating data exfiltration such as Yes, explicit content is sold or publicly posted and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with moderate to high confidence (70%), supported by evidence indicating sold on underground marketplaces,data sold on dark web such as Yes. Under the Impact tactic, the analysis identified Data Destruction (T1485) with moderate confidence (50%), supported by evidence indicating publicly posted, often accompanied by personal information, Defacement: Internal Defacement (T1491.001) with moderate to high confidence (70%), supported by evidence indicating advertising the stolen material on the victim’s own social media profiles, and Data Manipulation: Stored Data Manipulation (T1565.001) with moderate confidence (60%), supported by evidence indicating victims frequently face further harassment, sextortion, or stalking. Under the Defense Evasion tactic, the analysis identified Modify Authentication Process: Multi-Factor Authentication (T1556.006) with moderate confidence (60%), supported by evidence indicating tricking victims into...providing verification codes and Masquerading: Match Legitimate Name or Location (T1036.005) with moderate to high confidence (80%), supported by evidence indicating impersonate social media support teams, fake login pages mimicking legitimate platforms. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.