Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Jeremiah Roe MEMBER_OF Geek Squad
Jeremiah previously got a job at Geek Squad troubleshooting customers' computer problems.
Explicit Confidence 99% · Jack Rhysider EP 125 Details
“He went into the military and then got a job at Geek Squad troubleshooting customers’ computer problems”
time-based malware RELATED_TO time-based backdoor
Jeremiah presents time-based malware and a time-based backdoor as analogous possible consequences of malicious code being introduced into a software development lifecycle.
Uncertain Confidence 82% · Jeremiah Roe EP 125 Details
“that could be almost like a time-based malware or a time-based backdoor”
Jeremiah Roe USES red team operations
Jeremiah says he was part of the organization's internal red team operations.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“We were both the internal pen test team and the internal red team operations”
Jeremiah Roe USES Tailgating
Jeremiah deliberately followed an employee through a badge-controlled door to test whether the employee would challenge him.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“I decided I was gonna impromptu follow this person and try to see if I can do tailgating”
Network Access Control USES MAC address
The episode explains that Network Access Control checks a computer's MAC address to determine what network access it receives.
Explicit Confidence 99% · Jack Rhysider EP 125 Details
“the router takes a look at your MAC address of your computer to see if that computer should have special access”
Jeremiah Roe USES LANstar
Jeremiah brought a Lanstar to potentially tap network connections.
Explicit Confidence 98% · Jeremiah Roe EP 125 Details
“I had a Lanstar just in case I wanted to tap something in there”
Jeremiah Roe USES Bash Bunny
Jeremiah brought and used a Bash Bunny to execute a pre-written script on an unattended kiosk computer.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“we were able to plug in a Bash Bunny to execute the previously-written script”
Jeremiah Roe USES Google Maps
Jeremiah used Google Maps to gather information about the target location, its surroundings, entry points, and schedules.
Explicit Confidence 99% · Jack Rhysider EP 125 Details
“he started by simply Googling the location. Of course, this landed him on Google Maps”
Jeremiah Roe USES network-level penetration testing
Jeremiah says his government contracting work primarily focused on network-level penetration testing.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“we really primarily focused on conducting network-level penetration testing”
Jeremiah Roe USES lockpick set
Jeremiah brought a lockpick set as part of his physical red-team equipment.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“I had a lockpick set and a Raspberry Pi as well as a Bash Bunny”
Jeremiah Roe USES MAC address spoofing
Jeremiah changed his computer's MAC address to resemble an allowed printer address in order to bypass network access restrictions.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“Being able to conduct network access bypass with something so simple as changing your MAC”
Jeremiah Roe USES Raspberry Pi
Jeremiah brought a Raspberry Pi for the physical red-team operation.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“I had a lockpick set and a Raspberry Pi as well as a Bash Bunny”
Jeremiah Roe USES nation state style of an attack
The planned physical assessment was intended to imitate a nation-state-style attack.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“we wanted to conduct a nation state style of an attack from a physical perspective”
Jeremiah Roe USES physical penetration testing
Jeremiah and his team conducted a physical penetration test against a satellite location.
Explicit Confidence 98% · Jeremiah Roe EP 125 Details
“we wanted to take it upon ourselves to go ahead and conduct one towards this satellite location”
Jeremiah Roe USES web application penetration testing
Jeremiah says his government contracting work included web application penetration testing.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“web application penetration testing”
Jeremiah Roe USES Kali Linux
Jeremiah had a mobile version of Kali Linux installed on a burner phone for the operation.
Explicit Confidence 99% · Jeremiah Roe EP 125 Details
“I had actually a mobile version of Kali Linux installed on my ... burner phone”
REvil AFFECTS Kaseya VSA
REvil exploited Kaseya VSA to reach managed service providers and their customers.
Explicit Confidence 99% · Will EP 126 Details
“by exploiting the Kaseya software to deploy REvil, they were able to hit 1,500 networks in one go overnight”
Yevgeniy Polyanin ASSOCIATED_WITH REvil
Polyanin was charged as an alleged REvil ransomware attacker associated with approximately 3,000 attacks.
Attributed Confidence 96% · Will EP 126 Details
“Polyanin, whom we also charged by indictment, is alleged to have conducted approximately 3,000 ransomware attacks”
Yaroslav Vasinskyi ASSOCIATED_WITH REvil
Vasinskyi was presented as an alleged REvil affiliate and alleged perpetrator of the Kaseya-related ransomware attack.
Attributed Confidence 94% · Garland EP 126 Details
“bringing to justice an alleged perpetrator of a significant, wide-reaching ransomware attack”
REvil ASSOCIATED_WITH Federal Security Service
The FSB claimed to have arrested fourteen REvil members in Russia; the episode questions the credibility and meaning of those arrests.
Uncertain Confidence 86% · Will EP 126 Details
“the Russian FSB released a press release that said they had arrested fourteen members of REvil”
Will identifies DarkSide as FIN7’s first ransomware project.
Explicit Confidence 97% · Will EP 126 Details
“DarkSide was FIN7’s first ransomware project.”
REvil DEVELOPED_BY Yaroslav Vasinskyi
The U.S. Attorney General said the indictment charged that Vasinskyi and co-conspirators authored REvil software; this is an allegation in the indictment, not an adjudicated fact.
Attributed Confidence 98% · Jack Rhysider EP 126 Details
“The indictment charges that Vasinskyi and co-conspirators authored REvil software”
REvil EXPLOITS Kaseya servers vulnerability
The Kaseya attack used a vulnerability on Kaseya’s servers to give REvil a foothold.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“There was a vulnerability on Kaseya’s servers that gave REvil the foothold to take over a server.”
Kaseya ransomware attack INITIAL_ACCESS_VIA Kaseya VSA
REvil gained access to downstream networks through Kaseya VSA.
Derived Confidence 97% · Will EP 126 Details
“by going into the Kaseya software, REvil basically had a foothold into all of the MSP’s customers”
Kaseya ransomware attack INVOLVES supply chain attack
The Kaseya incident was described as a major supply-chain incident because compromise of Kaseya reached downstream customers.
Explicit Confidence 99% · Will EP 126 Details
“The Kaseya, that was basically one of the biggest supply chain incidents since NotPetya.”