Incident Score: Analysis & Impact (URA1775060765)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Exploit Public-Facing Application (T1190) with high confidence (90%), supported by evidence indicating exploited vulnerabilities in the platform’s smart contract code. Under the Execution tactic, the analysis identified Serverless Execution (T1648) with moderate to high confidence (80%), supported by evidence indicating manipulated a rewards system to withdraw $1.4 million via smart contract. Under the Persistence tactic, the analysis identified Compromise Client Software Binary (T1554) with moderate confidence (60%), supported by evidence indicating exploited a coding error to siphon funds from 26 liquidity pools. Under the Privilege Escalation tactic, the analysis identified Domain or Tenant Policy Modification (T1484) with moderate to high confidence (70%), supported by evidence indicating drained nearly 90% of its assets by exploiting smart contract code. Under the Defense Evasion tactic, the analysis identified Valid Accounts: Cloud Accounts (T1078.004) with moderate confidence (50%), supported by evidence indicating negotiated a fraudulent $386,000 bug bounty and Hide Artifacts: Hidden Window (T1564.003) with moderate to high confidence (70%), supported by evidence indicating laundered through decentralized exchanges and Tornado Cash mixer. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Bash History (T1552.003) with moderate confidence (60%), supported by evidence indicating exploited a coding error in liquidity pools to siphon funds. Under the Lateral Movement tactic, the analysis identified Use Alternate Authentication Material: Pass the Hash (T1550.002) with moderate confidence (50%), supported by evidence indicating accessed 26 liquidity pools to drain funds. Under the Collection tactic, the analysis identified Data from Information Repositories: Sharepoint (T1213.002) with lower confidence (40%), supported by evidence indicating drained nearly 90% of its assets from the platform. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating stolen cryptocurrency was laundered through decentralized exchanges and Automated Exfiltration (T1020) with moderate to high confidence (80%), supported by evidence indicating $53.3 million stolen in two separate attacks. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with lower confidence (30%), supported by evidence indicating platform shutdown due to drained assets and Defacement: Internal Defacement (T1491.001) with moderate to high confidence (70%), supported by evidence indicating drained nearly 90% of its assets, forcing shutdown. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.