Incident Score: Analysis & Impact (T-MEXP1781606328)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), supported by evidence indicating vulnerable API endpoint exploited since November 25, 2022, Trusted Relationship (T1199) with high confidence (95%), supported by evidence indicating reliance on Experian for credit checks led to exposure of 15M customers, and External Remote Services (T1133) with moderate to high confidence (80%), supported by evidence indicating accessed via an unprotected GPRS gateway using brute-force tactics. Under the Execution tactic, the analysis identified Native API (T1106) with moderate to high confidence (70%), supported by evidence indicating aPI vulnerability exploited to access customer data. Under the Credential Access tactic, the analysis identified Brute Force (T1110) with high confidence (90%), supported by evidence indicating brute-force tactics used to access T-Mobile’s systems via GPRS gateway and Container API (T1552.007) with moderate to high confidence (70%), supported by evidence indicating vulnerable API endpoint exploited to access account PINs and SSNs. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (80%), supported by evidence indicating exposed prepaid customer accounts, names, phone numbers, and account PINs and File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating compromised customer databases containing SSNs, driver’s licenses. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (95%), supported by evidence indicating 76.6M individuals’ data exposed, including SSNs, driver’s licenses, PINs and Data from Information Repositories (T1213) with high confidence (90%), supported by evidence indicating customer databases targeted across multiple breaches. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating data exfiltration alleged in 2021 breach and Transfer Data to Cloud Account (T1537) with moderate confidence (60%), supported by evidence indicating stolen data likely resold in underground markets. Under the Impact tactic, the analysis identified Data Destruction (T1485) with lower confidence (30%), supported by evidence indicating no evidence of data destruction, but high-volume breaches occurred and Stored Data Manipulation (T1565.001) with lower confidence (40%), supported by evidence indicating account PINs and proprietary network info compromised. Under the Defense Evasion tactic, the analysis identified Disable or Modify Tools (T1562.001) with moderate confidence (50%), supported by evidence indicating weak authentication controls contributed to repeated breaches and Valid Accounts (T1078) with moderate to high confidence (70%), supported by evidence indicating unauthorized access to prepaid customer accounts (2019). These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.