Incident Score: Analysis & Impact (SSLNATOR-1780945453)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), supported by evidence indicating managing director was tricked into entering credentials on a fake Office 365 login page, Exploit Public-Facing Application (T1190) with moderate to high confidence (70%), with evidence including third-party mail service provider breach (NBA), and network-connected systems (2018 Olympics), and Trusted Relationship (T1199) with moderate to high confidence (80%), supported by evidence indicating third-party vulnerabilities exploited (NBA, ASVEL, KNVB). Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating olympic Destroyer malware disabled Wi-Fi, telecasts, and ticketing systems and Command and Scripting Interpreter (T1059) with moderate to high confidence (70%), supported by evidence indicating malware spread across connected networks (2018 Olympics). Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating credentials stolen via fake Office 365 login page (Premier League club). Under the Privilege Escalation tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating stolen credentials used to divert $2.5M transfer (Lazio Rome). Under the Defense Evasion tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with moderate to high confidence (80%), supported by evidence indicating fake Office 365 login page used to steal credentials and Obfuscated Files or Information (T1027) with moderate to high confidence (70%), supported by evidence indicating olympic Destroyer malware wiped data and stole passwords. Under the Credential Access tactic, the analysis identified Credentials from Password Stores (T1555) with moderate to high confidence (80%), supported by evidence indicating olympic Destroyer malware stole passwords (2018 Olympics) and Brute Force (T1110) with moderate confidence (60%), supported by evidence indicating aPT groups (Sandworm, Fancy Bear) targeted high-profile events. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (70%), supported by evidence indicating 500 GB of data exfiltrated (Houston Rockets), including player contracts. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating 500 GB (Houston Rockets), 32 GB (ASVEL), decades of records (KNVB) exfiltrated and Data from Information Repositories (T1213) with moderate to high confidence (80%), supported by evidence indicating player contracts, financial records, medical records compromised. Under the Command and Control tactic, the analysis identified Application Layer Protocol (T1071) with moderate to high confidence (70%), supported by evidence indicating malware spread across connected networks (2018 Olympics). Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating 500 GB (Houston Rockets), 32 GB (ASVEL), decades of records (KNVB) exfiltrated and Exfiltration Over Web Service (T1567) with moderate to high confidence (70%), supported by evidence indicating data exfiltrated via ransomware attacks (Babuk, NoEscape, LockBit). Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating ransomware attacks (Manchester United, San Francisco 49ers, ASVEL, KNVB), Data Destruction (T1485) with moderate to high confidence (80%), supported by evidence indicating olympic Destroyer malware wiped data (2018 Olympics), and Defacement (T1491) with moderate to high confidence (70%), supported by evidence indicating boca Juniors YouTube channel hijacked for cryptocurrency scam. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.