Incident Score: Analysis & Impact (UNN1779280574)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with moderate to high confidence (80%), with evidence including exploiting n-day vulnerability, and undocumented n-day vulnerability, Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating accessible from corporate workstations using default credentials, and External Remote Services (T1133) with moderate to high confidence (70%), supported by evidence indicating solaris servers accessible from public internet. Under the Execution tactic, the analysis identified Exploitation for Client Execution (T1203) with moderate to high confidence (70%), supported by evidence indicating deploying new malware after cleanup attempts and System Services: Service Execution (T1569.002) with moderate confidence (60%), supported by evidence indicating vulnerability scan triggered catastrophic shutdown. Under the Persistence tactic, the analysis identified Account Manipulation (T1098) with moderate to high confidence (80%), supported by evidence indicating maintaining persistent access even after cleanup attempts and Create or Modify System Process: Windows Service (T1543.003) with moderate confidence (60%), supported by evidence indicating malware using DNS tunneling for command-and-control. Under the Privilege Escalation tactic, the analysis identified Exploitation for Privilege Escalation (T1068) with moderate to high confidence (70%), supported by evidence indicating exploiting n-day vulnerability for persistent access and Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating default credentials used to access Solaris servers. Under the Defense Evasion tactic, the analysis identified Impair Defenses: Disable or Modify Tools (T1562.001) with moderate to high confidence (70%), supported by evidence indicating expulsion of cybersecurity team for years, Masquerading (T1036) with moderate confidence (60%), supported by evidence indicating dNS traffic initially dismissed as noise, and Modify Cloud Compute Infrastructure (T1578) with moderate confidence (50%), supported by evidence indicating misconfigured firewalls left critical systems vulnerable. Under the Credential Access tactic, the analysis identified Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating default credentials used to access Solaris servers and Brute Force: Password Guessing (T1110.001) with moderate to high confidence (70%), supported by evidence indicating accessible using default credentials. Under the Discovery tactic, the analysis identified Account Discovery: Local Account (T1087.001) with moderate to high confidence (70%), supported by evidence indicating discovery of forgotten Solaris servers and Network Service Discovery (T1046) with moderate to high confidence (80%), supported by evidence indicating revealed deep visibility into proprietary industrial protocols. Under the Lateral Movement tactic, the analysis identified Exploitation of Remote Services (T1210) with moderate to high confidence (80%), supported by evidence indicating extensive interconnections between IT and OT networks and Lateral Tool Transfer (T1570) with moderate to high confidence (70%), supported by evidence indicating open pathways for lateral movement. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (80%), supported by evidence indicating mission-critical field control data compromised and Automated Collection (T1119) with moderate to high confidence (70%), supported by evidence indicating proprietary industrial protocols exposed. Under the Command and Control tactic, the analysis identified Application Layer Protocol: DNS (T1071.004) with high confidence (90%), supported by evidence indicating malware using DNS tunneling for command-and-control and Proxy: Multi-hop Proxy (T1090.003) with moderate confidence (60%), supported by evidence indicating aPT actor bypassed containment efforts. Under the Exfiltration tactic, the analysis identified Exfiltration Over Alternative Protocol: DNS (T1048.003) with high confidence (90%), supported by evidence indicating dNS tunneling for data exfiltration and Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating data exfiltration via DNS tunneling. Under the Impact tactic, the analysis identified Data Destruction for Impact (T0880) with moderate confidence (50%), supported by evidence indicating catastrophic shutdown of two turbines and Loss of Productivity and Revenue (T0829) with moderate to high confidence (80%), supported by evidence indicating disrupted operations, production disruption. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.