Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
NiceHash hack INVOLVES lateral movement
After compromising an employee computer, the attackers moved deeper into the NiceHash network.
Explicit Confidence 98% · Jack Rhysider EP 119 Details
“they burrowed their way deeper into the NiceHash network, pivoting”
Tony Walker SAME_AS Kim Il
The US government says Tony Walker, also known as Julian Kim, was actually Kim Il.
Attributed Confidence 94% · Geoff White EP 119 Details
“the US says is the real name of Tony Walker and Julian Kim”
Bobby Sierra USES identity spoofing
Bobby Sierra was described as someone spoofing another person's legitimate resume and identity during a job interview.
Explicit Confidence 99% · Jon Wu EP 119 Details
“He was clearly spoofing someone’s legitimate resume and pretending to be them”
Tony Walker USES identity spoofing
Tony Walker used the name Julian Kim when signing Marine Chain contracts.
Explicit Confidence 98% · Geoff White EP 119 Details
“he’s signing himself Julian Kim”
Lazarus Group USES targeted phishing
The episode describes phishing emails attributed to Lazarus as carefully crafted for specific employees at specific companies.
Attributed Confidence 97% · Jack Rhysider EP 119 Details
“these phishing e-mails were often very well-crafted to target a specific person”
WannaCry USES cryptocurrency mixer
The attackers moved WannaCry ransom payments through wallets and cryptocurrency mixers to launder them.
Explicit Confidence 96% · Geoff White EP 119 Details
“the money being moved around, moved to different wallets, tumbled”
Gulf Bank service disruption ASSOCIATED_WITH banking malware
Mohammed believed there might be a possible connection between the banking malware he found and the Gulf Bank incident, but said there was not enough concrete proof to link them.
Uncertain Confidence 97% · Mohammed Aldoub EP 120 Details
“there’s a possible connection there”
“there wasn’t a lot of, let’s say, concrete proof for me to be able to do that”
Mohammed Aldoub ASSOCIATED_WITH Dan Kaminsky
Mohammed says he was introduced to Dan Kaminsky, whose guidance helped him enter cybersecurity.
Explicit Confidence 98% · Mohammed Aldoub EP 120 Details
“I actually got introduced to the late Dan Kaminsky, and his guidance was really amazing”
Kuwait bank robbery report ATTRIBUTED_TO Government of North Korea
The United Nations investigation report says the government of North Korea was responsible for robbing a bank in Kuwait in March 2019.
Attributed Confidence 99% · Mohammed Aldoub EP 120 Details
“this report says the government of North Korea is responsible for robbing banks in ... Kuwait”
“a bank in Kuwait was robbed by the government of North Korea”
Gulf Bank service disruption INVOLVES Gulf Bank of Kuwait
The incident was reported by Gulf Bank of Kuwait as a service disruption that resulted in a loss of millions of dollars.
Explicit Confidence 99% · Jack Rhysider EP 120 Details
“the Gulf Bank of Kuwait’s Twitter account saying they had a service disruption”
“This service disruption resulted in them losing $9 million”
Kuwait bank robbery report INVOLVES phishing
The broader bank-robbery campaign described in the episode commonly began with phishing emails sent to banking employees; the episode connects this campaign context to the Kuwait robbery report without establishing that phishing was used in the Kuwait case specifically.
Derived Confidence 72% · Jack Rhysider EP 120 Details
“usually sending phishing e-mails to banking employees”
Kuwait bank robbery report INVOLVES Swift
The broader bank-robbery campaign described in the episode involved compromising banks and targeting the SWIFT network to steal money; the episode discusses whether the Kuwait case was part of this campaign.
Derived Confidence 78% · Jack Rhysider EP 120 Details
“hacking into the bank, and then targeting the SWIFT network to steal millions of dollars from banks”
Mohammed Aldoub MEMBER_OF Kuwaiti government
Mohammed says he got a job in the Kuwaiti government securing systems.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“I got a job in the government of Kuwait securing systems”
Kuwait bank robbery report TARGETS Kuwait
The UN report describes a bank robbery in Kuwait.
Attributed Confidence 98% · Jack Rhysider EP 120 Details
“a bank in Kuwait was robbed”
Mohammed Aldoub USES malware analysis
Mohammed analyzed fresh malware samples and streamed or discussed his analysis publicly.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“trying to analyze the malware, how it works, what it does to the systems”
“downloaded and analyze it, and actually discussed on Twitter”
Mohammed Aldoub USES Strings extraction
Mohammed used strings extraction to identify human-readable strings in the malware, including GBKADMIN.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“I found some strings in those pieces of malware”
“one technique for analyzing malware is to run the command ‘strings’ on it”
Mohammed Aldoub USES Indicators of compromise
Mohammed submitted malware hashes and shared indicators so people in the region could search their environments for the attack.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“submitted the hashes for that piece of malware so that anybody in the region could search for those hashes in their environment”
“these are some highly-probable indicators of compromise”
Mohammed Aldoub USES VirusTotal
Mohammed says he used VirusTotal to look for malware samples and attacks targeting Kuwait and the region.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“One of the best avenues to look for such things is through using VirusTotal”
“I would use it to actually look for attacks that are targeting Kuwait”
Mohammed Aldoub USES Threat hunting
Mohammed describes conducting threat-hunting work to find malware targeting Kuwait and the Gulf region.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“it was usually something regular that we tried to hunt for threats”
“I’m doing that usual threat hunting work”
Biohacking Village Device Lab ASSOCIATED_WITH Mayo Clinic
Beau says the Mayo Clinic built a Capture the Flag exercise for the Device Lab.
Explicit Confidence 99% · Beau Woods EP 121 Details
“We’ve also got a Capture the Flag that the Mayo Clinic built”
Ed Skoudis ASSOCIATED_WITH Defcon
Ed says he spoke at Defcon as part of his cybersecurity-industry work.
Explicit Confidence 99% · Ed Skoudis EP 121 Details
“I spoke at Defcon”
Biohacking Village Device Lab ASSOCIATED_WITH Food and Drug Administration
Beau says the FDA participates in the Device Lab through Suzanne Schwartz and Seth Carmody.
Explicit Confidence 99% · Beau Woods EP 121 Details
“We’ve got – the FDA is participating.”
Windows 7 ASSOCIATED_WITH Surgical laser
Ed says a surgical laser he encountered was controlled by a Windows 7 machine.
Explicit Confidence 99% · Ed Skoudis EP 121 Details
“the laser was controlled by a Windows 7 machine”
Capture the Flag DEVELOPED_BY Mayo Clinic
Beau attributes construction of a Capture the Flag exercise to the Mayo Clinic.
Explicit Confidence 98% · Beau Woods EP 121 Details
“a Capture the Flag that the Mayo Clinic built”
Counter Hack DEVELOPED_BY Ed Skoudis
Ed Skoudis identifies himself as the founder of Counter Hack.
Explicit Confidence 99% · Ed Skoudis EP 121 Details
“founder of Counter Hack”