Incident Score: Analysis & Impact (WIRGOO1781655885)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (95%), with evidence including phishing attacks against Gmail users, and fake login pages that mimic Gmail’s interface, Phishing: Spearphishing Link (T1566.001) with high confidence (90%), with evidence including emails...directing victims to fake login pages, and phishing domains almost daily, and Phishing: Spearphishing Attachment (T1566.002) with lower confidence (30%), supported by evidence indicating no evidence of malicious attachments in description. Under the Credential Access tactic, the analysis identified Input Capture: Keylogging (T1056.001) with moderate to high confidence (80%), supported by evidence indicating capturing passwords and 2FA codes via fake login pages, Brute Force (T1110) with moderate confidence (50%), supported by evidence indicating broad guessing of email addresses, and Modify Authentication Process: Multi-Factor Authentication (T1556.006) with high confidence (90%), supported by evidence indicating steal login credentials and two-factor authentication (2FA) codes. Under the Collection tactic, the analysis identified Data from Local System (T1005) with moderate to high confidence (70%), with evidence including exfiltrating sensitive documents, and hijacking linked social media accounts and Data from Information Repositories (T1213) with moderate to high confidence (80%), with evidence including sensitive documents compromised, and intelligence-gathering motives. Under the Command and Control tactic, the analysis identified Application Layer Protocol (T1071) with moderate to high confidence (70%), supported by evidence indicating phishing pages hosted on compromised Polish websites and Dynamic Resolution (T1568) with high confidence (90%), supported by evidence indicating dynamically rotated domains (e.g., *.icu, .digital, .top). Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), with evidence including data exfiltration such as Yes, and sensitive documents compromised. Under the Defense Evasion tactic, the analysis identified Hide Artifacts: Hidden Files and Directories (T1564.001) with moderate confidence (60%), supported by evidence indicating compromised Polish websites...without altering the main site and Masquerading (T1036) with high confidence (90%), with evidence including emails impersonate Gmail administrator notices, and sender addresses like [email protected]. Under the Reconnaissance tactic, the analysis identified Active Scanning (T1595) with moderate to high confidence (70%), with evidence including broad guessing of email addresses, and targets high-profile Polish individuals. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.