Incident Score: Analysis & Impact (UNIWESFOX1780562007)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate confidence (60%), supported by evidence indicating ransomware attacks increased by 3% in May 2026, with 661 incidents recorded and External Remote Services (T1133) with moderate confidence (50%), supported by evidence indicating no specific attack vector disclosed, but ransomware groups active. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating ransomware attacks recorded, implying malicious file execution and Command and Scripting Interpreter: PowerShell (T1059.001) with moderate confidence (50%), supported by evidence indicating common ransomware tactic, though not explicitly mentioned. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate confidence (60%), supported by evidence indicating ransomware groups likely used compromised credentials. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate confidence (50%), supported by evidence indicating ransomware attacks often involve privilege escalation. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate to high confidence (70%), supported by evidence indicating ransomware strains like Qilin and DragonForce likely use obfuscation and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate confidence (60%), supported by evidence indicating ransomware often disables security tools. Under the Credential Access tactic, the analysis identified OS Credential Dumping (T1003) with moderate to high confidence (70%), supported by evidence indicating 120,000+ records exposed (Unimed), implying credential access and Credentials from Password Stores (T1555) with moderate confidence (60%), supported by evidence indicating high identity theft risk noted in incident. Under the Discovery tactic, the analysis identified File and Directory Discovery (T1083) with moderate confidence (60%), supported by evidence indicating 115 TB of data stolen, implying discovery phase. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating 8 TB of data stolen from Foxconn North America and Data from Network Shared Drive (T1039) with moderate to high confidence (70%), supported by evidence indicating 20.8 TB stolen by DragonForce, largest volume reported. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating nearly 115 TB of data stolen across all attacks and Exfiltration Over Web Service (T1567) with moderate confidence (60%), supported by evidence indicating iNC auctioned 200–300 GB of stolen data. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (90%), supported by evidence indicating ransomware attacks with data encryption confirmed and Data Destruction (T1485) with moderate confidence (50%), supported by evidence indicating ransomware may involve destructive tactics. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.