Drew says his story began at age thirteen with playing Roblox.
Explicit Confidence 99% · Drew EP 112 Details
“it starts at age thirteen at Roblox, like playing Roblox”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Drew says his story began at age thirteen with playing Roblox.
Explicit Confidence 99% · Drew EP 112 Details
“it starts at age thirteen at Roblox, like playing Roblox”
Drew USES Google Ads
Jack says Drew set up and ran Google Ads to attract people to his phishing site.
Explicit Confidence 98% · Jack Rhysider EP 112 Details
“he learned how to clone a website ... and started running Google Ads himself”
Drew USES Roblox botnet
Drew hired a Roblox botmaster service to add artificial players to his game, although the service allegedly did not deliver them.
Explicit Confidence 98% · Jack Rhysider EP 112 Details
“he hired a service like a Roblox botmaster kind of thing”
“The botmaster takes the money, but doesn’t deliver users to his game”
Academy network attack COMPROMISES The Academy
The attack compromised and destroyed The Academy’s network infrastructure.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam had obliterated the Academy’s whole infrastructure”
Adam Georgeson EXPLOITS shared local administrator password
Adam exploited the Academy’s use of the same local administrator password on all student computers.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“it was the same one at every single computer in the school”
Adam Georgeson EXPLOITS weak and reused administrative passwords
Adam exploited weak, reused, and patterned administrative passwords, including the domain administrator password.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“he guessed what the domain admin password was”
Academy network attack INITIAL_ACCESS_VIA Office 365
The attack initially gained access through the Academy’s Office 365 administrator account.
Derived Confidence 96% · Jack Rhysider EP 113 Details
“He was logged into the school’s admin portal on Office 365.”
Unnamed IT company network attack INVOLVES credentialed remote access
The later attack used retained domain administrator credentials to access the employer’s network services.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He uses the domain admin credentials that he still had written down”
Academy network attack INVOLVES mobile device wipe
The attack included an attempt to wipe 2,947 mobile devices connected to the Academy’s Office 365 environment.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam had just attempted to wipe 2,947 devices”
Academy network attack INVOLVES backup server
The attack involved wiping the Academy’s backup and secondary backup servers.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“There was a backup server and a secondary backup server”
Unnamed IT company network attack INVOLVES log and evidence evasion
The later attack included uninstalling software and changing administrator passwords, actions that disrupted systems and limited access.
Explicit Confidence 96% · Jack Rhysider EP 113 Details
“he changed their passwords so they couldn’t log in anymore”
Academy network attack INVOLVES Domain controller
The attack involved running a destructive wipe command against a domain controller.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“I ran that on I think the domain controller.”
Academy network attack INVOLVES VPN
The attack involved gaining VPN access to the Academy’s internal network.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He successfully VPNs into the school’s network”
Academy network attack INVOLVES lateral movement
The attack involved lateral movement across multiple Academy systems and servers.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“What he’s doing is a classic example of lateral movement”
Academy network attack INVOLVES log and evidence evasion
Adam attempted to cover his tracks by deleting logs and other evidence, although he could not access the firewall logs.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“let’s try and get rid of as much as possible to try and cover my tracks”
Academy network attack INVOLVES hypervisor
The attack reached a hypervisor hosting the network’s backups, which were then wiped.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“it was a hypervisor, basically”
Unnamed IT company network attack INVOLVES Office 365
The later attack against Adam’s employer involved logging into the company’s Office 365 portal and reaching its global administrator account.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He uses the domain admin credentials that he still had written down somewhere to log into this company’s Office 365 portal.”
Unnamed IT company network attack INVOLVES privilege escalation
The later attack involved moving from the Office 365 portal to the global administrator account.
Explicit Confidence 98% · Jack Rhysider EP 113 Details
“From there, he gets access to the global administrator account”
Academy network attack INVOLVES destructive data wiping
The attack involved wiping servers, domain controllers, backups, and other infrastructure.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“the process of wiping the entire servers that I was on”
Adam Georgeson MEMBER_OF The Academy
Adam worked as an IT apprentice and technician at The Academy before being dismissed.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“The job was to do IT work at the Academy.”
Adam Georgeson USES credentialed remote access
Adam used saved credentials and Remote Desktop connections to access additional computers and servers.
Explicit Confidence 98% · Adam Georgeson EP 113 Details
“there was sort of saved credentials”
Adam Georgeson USES privilege escalation
Adam escalated from a lower-level Office 365 account to an account with super-administrator rights.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He’s done what’s called privilege escalation.”
The Academy USES Skype
Skype was configured through the Academy’s Office 365 environment.
Explicit Confidence 94% · Jack Rhysider EP 113 Details
“configure Skype, see SharePoint sites”
Adam Georgeson USES lateral movement
Adam moved from one computer to another across the Academy’s network to reach infrastructure systems.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam kept hopping from one system to another”
Adam Georgeson USES password guessing
Adam guessed Office 365 and VPN passwords by following the Academy’s password patterns.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“After a few hours at guessing VPN passwords, he finally gets it.”