Incident Score: Analysis & Impact (VEEFORCIT1781857680)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), supported by evidence indicating initial access is often gained through spear-phishing, Valid Accounts (T1078) with high confidence (90%), supported by evidence indicating compromised credentials from access brokers, and Exploit Public-Facing Application (T1190) with high confidence (95%), supported by evidence indicating exploitation of known vulnerabilities in public-facing systems (CVE-2023-3519, CVE-2023-48788, CVE-2025-5777). Under the Execution tactic, the analysis identified Command and Scripting Interpreter: PowerShell (T1059.001) with high confidence (90%), supported by evidence indicating deploying a customized PowerShell script that extracts credentials and Command and Scripting Interpreter: Windows Command Shell (T1059.003) with moderate to high confidence (80%), supported by evidence indicating attackers use command-line tools to map the network. Under the Persistence tactic, the analysis identified Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating compromised credentials from access brokers. Under the Privilege Escalation tactic, the analysis identified OS Credential Dumping (T1003) with high confidence (90%), supported by evidence indicating extracts credentials from Veeam backup servers via salted DPAPI decryption. Under the Defense Evasion tactic, the analysis identified Obfuscated Files or Information (T1027) with moderate to high confidence (80%), supported by evidence indicating ransomware payloads rewritten in Rust for cross-platform attacks, Execution Guardrails (T1480) with moderate to high confidence (70%), supported by evidence indicating partial encryption to avoid critical system files, and Indicator Removal: File Deletion (T1070.004) with moderate confidence (60%), supported by evidence indicating no details on malware’s cleanup post-encryption. Under the Credential Access tactic, the analysis identified OS Credential Dumping: NTDS (T1003.003) with moderate to high confidence (70%), supported by evidence indicating extracts credentials from Veeam backup servers and Credentials from Password Stores (T1555) with moderate to high confidence (80%), supported by evidence indicating salted DPAPI decryption for credential extraction. Under the Discovery tactic, the analysis identified Network Service Discovery (T1046) with high confidence (90%), supported by evidence indicating attackers use IP scanners to map the network and Account Discovery (T1087) with moderate to high confidence (70%), supported by evidence indicating credential extraction implies account discovery. Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with moderate to high confidence (70%), supported by evidence indicating network mapping and credential use suggest lateral movement and Remote Services: SMB/Windows Admin Shares (T1021.002) with moderate to high confidence (70%), supported by evidence indicating credential extraction and network mapping imply SMB use. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating backup data, virtual machines, and sensitive files compromised. Under the Command and Control tactic, the analysis identified Application Layer Protocol (T1071) with moderate to high confidence (70%), supported by evidence indicating private portal for negotiations implies C2 communication. Under the Exfiltration tactic, the analysis identified Exfiltration Over Web Service (T1567) with high confidence (90%), supported by evidence indicating public leak site to pressure non-compliant victims and Exfiltration Over Alternative Protocol (T1048) with moderate to high confidence (80%), supported by evidence indicating rclone likely used for data exfiltration. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (100%), supported by evidence indicating curve25519 ECC and AES-128 encryption, ransomware payloads, Inhibit System Recovery (T1490) with high confidence (90%), supported by evidence indicating shuts down virtual machines before encrypting them, and Service Stop (T1489) with moderate to high confidence (80%), supported by evidence indicating shutdown of virtual machines to maximize disruption. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.