Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Dark Caracal ASSOCIATED_WITH Lebanon
Jack says there are clues suggesting that the Lebanese government is somehow behind Dark Caracal, while noting that the group's identity is not certain.
Uncertain Confidence 88% · Jack Rhysider EP 135 Details
“there are quite a bit of clues that lead us to believe that the Lebanese government is somehow behind this Dark Caracal group”
The D.R. Incident ATTRIBUTED_TO Dark Caracal
The campaign was associated with Dark Caracal in the investigation, but the episode emphasizes that attribution was not clear.
Uncertain Confidence 72% · Omar Avilez EP 135 Details
“it was not just Dark Caracal; it was not just Conti”
“This attribution wasn’t exactly clear”
Jack says Conti has been widely attributed to Russia.
Attributed Confidence 91% · Jack Rhysider EP 135 Details
“Conti has been widely-attributed to be from Russia”
The D.R. Incident ATTRIBUTED_TO Russia
Omar says his partners told him Russia was involved in the Dominican Republic campaign, but he also presents the attribution as uncertain and based on what they learned during the investigation.
Uncertain Confidence 72% · Omar Avilez EP 135 Details
“they told us that it was not just Dark Caracal; it was not just Conti, but also it was — Russia was also involved”
The D.R. Incident INITIAL_ACCESS_VIA phishing
The investigation found that the attackers entered the network through a phishing attack.
Explicit Confidence 99% · Omar Avilez EP 135 Details
“the attackers got into the network via a phishing attack”
Costa Rica ransomware attack INITIAL_ACCESS_VIA phishing
The Costa Rica campaign infected departments through phishing emails as well as other internet-connected systems.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“They were attacking government organizations through phishing”
The D.R. Incident INVOLVES Conti
The Dominican Republic campaign included Conti-related command-and-control activity and staged Conti ransomware, although the ransomware was stopped before execution.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“a Cobalt Strike implant which was communicating to Conti’s C2”
“they seemed to have stopped the Conti ransomware attack before it actually triggered ransomware on any systems”
The D.R. Incident INVOLVES operational technology
The campaign reached critical infrastructure, but the attackers could not disrupt the operational technology controlling it.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“They tried to but they could not. The critical infrastructure works — what we call the OT, which is operational technology”
The D.R. Incident INVOLVES Fortinet firewall vulnerability
The Quantum attackers exploited a Fortinet firewall vulnerability to obtain VPN access to the infrastructure.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“They exploited a vulnerability, a Fortinet firewall that allowed them to have VPN access to the infrastructure”
The D.R. Incident INVOLVES Quantum ransomware
The Dominican Republic agricultural department suffered a ransomware attack attributed in the report to the Quantum ransomware group.
Explicit Confidence 98% · Host2 EP 135 Details
“The Dominican Republic’s agricultural department has suffered a ransomware attack by the Quantum ransomware group”
The D.R. Incident INVOLVES Bandook
Hundreds of phishing emails contained or used Bandook as the attackers' backdoor.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“all of them had a backdoor the attackers were using, which was a backdoor known as Bandook”
Costa Rica ransomware attack INVOLVES Conti
Twenty Costa Rican government organizations were hit with Conti ransomware.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“twenty different government organizations in Costa Rica were hit with this Conti ransomware”
The D.R. Incident INVOLVES Cobalt Strike
A compromised system downloaded Cobalt Strike, and a later Cobalt Strike implant communicated with Conti's command-and-control infrastructure.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“a system did get infected and it reached out to the command and control server to download Cobalt Strike”
“they now downloaded or installed a second malware, which was a Cobalt Strike implant which was communicating to Conti’s C2”
Omar Avilez MEMBER_OF Dominican Republic National CSIRT
Omar says he used to work in the Dominican Republic National CSIRT.
Explicit Confidence 99% · Omar Avilez EP 135 Details
“I used to work in the Dominican Republic National CSIRT”
Conti USES command and control server
A command-and-control server was utilized by Conti to control infected systems.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“a C2 server that was utilized by Conti”
Cobalt Strike USES command and control server
The Cobalt Strike implant communicated with Conti's command-and-control server.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“a Cobalt Strike implant which was communicating to Conti’s C2”
Dominican Republic National CSIRT USES DNS
The Dominican Republic CSIRT implemented a tool to analyze DNS queries across government organizations for visibility into network activity.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“we got a tool to analyze all the DNS queries that the organization made”
Dominican Republic National CSIRT USES Threat intelligence
The CSIRT used threat intelligence by comparing observed domains against known malicious domains.
Explicit Confidence 95% · Jack Rhysider EP 135 Details
“This is called threat intelligence”
Joy-Con paperclip glitch AFFECTS Nintendo Switch
The Joy-Con paperclip glitch allowed a Switch to boot into recovery mode and access diagnostic tools.
Explicit Confidence 99% · Jack Rhysider EP 136 Details
“you could then get it to boot into recovery mode and have access to diagnostic tools”
PCSX AFFECTS PlayStation Classic
The PlayStation Classic used the PCSX emulator, with Sony adding its own interface around it.
Explicit Confidence 99% · Jack Rhysider EP 136 Details
“The mini PlayStation used the PCSX emulator”
Steam publication workflow bypass AFFECTS Steam
The exploit bypassed Steam's game publication and review workflow.
Explicit Confidence 98% · Jack Rhysider EP 136 Details
“they were able to send data to Steam saying the game is currently published”
Gary Bowser ASSOCIATED_WITH Team Xecuter
Gary described himself as a PR and intermediary figure for Team Xecuter, not a developer.
Explicit Confidence 99% · Gary Bowser EP 136 Details
“I was never on the actual development side of doing the actual exploits of the coding.”
George Hotz ASSOCIATED_WITH Sony
Sony pursued legal action against George Hotz after he publicly posted the PlayStation 3 root key.
Explicit Confidence 98% · Gary Bowser EP 136 Details
“Sony cracked down hard. They went after geohot”
Team Xecuter ASSOCIATED_WITH MAXiMiLiEN
MAXiMiLiEN bought the Team Xecuter branding, website, and supply chain from Paul Owen, making him closely associated with the group.
Explicit Confidence 99% · Jack Rhysider EP 136 Details
“The Team Xecuter branding, the website, the supply chain, everything was sold to MAXiMiLiEN.”
Classic 2 Magic DEVELOPED_BY Team Xecuter
The Classic 2 Magic was described as a Team Xecuter product sold under a different brand.
Explicit Confidence 99% · Jack Rhysider EP 136 Details
“Both of these products were by Team Xecuter, but they were selling it under a different brand”