Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Grifter says he eventually began running all the technical operations for Black Hat and later ran its network operations center.
Explicit Confidence 98% · Grifter EP 157 Details
“I eventually started running all the technical operations for Black Hat”
Grifter says he became a Defcon goon and remained one from Defcon 10 onward, while also serving in other conference roles.
Explicit Confidence 99% · Grifter EP 157 Details
“At Defcon 10 I was a security goon, and then at Defcon 11 I went and I was a vendor goon. Yeah, and then I’ve been a goon ever since”
Grifter MEMBER_OF IBM X-Force
Grifter says he previously spent three years with IBM’s X-Force running its global threat-hunting program.
Explicit Confidence 99% · Grifter EP 157 Details
“I was with IBM’s X-Force for three years running their global threat-hunting program”
Grifter MEMBER_OF RSA Security
Grifter says he previously worked for seven years at RSA Security, where he started and ran its global threat-hunting program.
Explicit Confidence 99% · Grifter EP 157 Details
“for the seven years before that, I was at RSA Security where I started and ran their threat-hunting program around the world”
Grifter says he joined the Air Force at age seventeen after graduating high school.
Explicit Confidence 99% · Grifter EP 157 Details
“as soon as I graduated, I went to the Air Force”
Grifter says he recently took a position at Coalfire as vice president of defensive services.
Explicit Confidence 99% · Grifter EP 157 Details
“I recently took a position at a company called Coalfire as the VP of defensive services”
Wi-Fi Village PART_OF DEF CON
The Wi-Fi Village is described as another village created at Defcon alongside the Lockpick and Hardware Hacking Villages.
Explicit Confidence 95% · Grifter EP 157 Details
“Then another group started the Wi-Fi Village”
Lockpick Village PART_OF DEF CON
The Lockpick Village is described as the first village created within the Defcon conference.
Explicit Confidence 95% · Grifter EP 157 Details
“the first ones to call themselves a village was the Lockpick Village”
Hardware Hacking Village PART_OF DEF CON
The Hardware Hacking Village was established as one of the broken-out areas at Defcon.
Explicit Confidence 95% · Grifter EP 157 Details
“the hardware-hacking people called themselves the Hardware Hacking Village”
Grifter says he used carding, which he defines as identity theft and credit-card fraud, to order goods and have them delivered to abandoned houses.
Explicit Confidence 99% · Grifter EP 157 Details
“carding is what we called it back in the day, which is basically just really identity theft and credit card fraud”
Grifter USES barcode swapping
Grifter describes using barcode or sticker swapping to buy expensive goods at lower prices and return them for profit.
Explicit Confidence 99% · Grifter EP 157 Details
“we’d all go on a Saturday and we’d go out to the store and we’d do the barcode swapping”
Grifter USES bulletin board systems
Grifter says his first online experiences involved dialing into pirate bulletin board systems to download pirated games, and later using a hacker BBS.
Explicit Confidence 99% · Grifter EP 157 Details
“my first online experiences, which were dialing into pirate bulletin board systems to download pirated games”
Grifter USES Threat hunting
Grifter describes spending more than a decade conducting threat hunting to find attackers who had bypassed an organization’s security.
Explicit Confidence 99% · Grifter EP 157 Details
“I spent a lot of the last — over a decade at this point really focused on threat hunting”
WannaCry infected and encrypted Windows computers.
Derived Confidence 96% · Jack Rhysider EP 158 Details
“Their computers would get infected and then completely encrypted.”
EternalBlue AFFECTS Windows
The EternalBlue exploit is described as affecting Microsoft Windows.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“the NSA found this exploit in Windows, Microsoft Windows”
Shadow Brokers ASSOCIATED_WITH Russia
The Shadow Brokers are said not to have been attributed at the time, but were widely believed to be Russian intelligence.
Uncertain Confidence 95% · Malwaretech EP 158 Details
“the Shadow Brokers isn’t — they haven’t been attributed yet, but it’s widely believed to be Russian intelligence”
WannaCry ATTRIBUTED_TO North Korea
WannaCry is attributed to someone working on behalf of the North Korean government; later, intelligence services publicly pointed to North Korea.
Attributed Confidence 96% · Malwaretech EP 158 Details
“I think the consensus is that it was someone working on behalf of the North Korean government.”
“the NSA and GCHQ and I think the Australian intelligence services, they all came out and they pointed the finger at North Korea”
EternalBlue DEVELOPED_BY National Security Agency
Jack says it was believed that the NSA developed the EternalBlue exploit.
Uncertain Confidence 84% · Jack Rhysider EP 158 Details
“We believe it was the NSA that developed the exploit, which they called EternalBlue.”
rootkit DEVELOPED_BY Marcus Hutchins
Marcus Hutchins says he started as a malware writer specializing in rootkits.
Explicit Confidence 98% · Malwaretech EP 158 Details
“I started out as a malware writer. I specialized in writing rootkits.”
Kronos DEVELOPED_BY Marcus Hutchins
Marcus Hutchins says he wrote malware code that was combined with banking code to create the Kronos banking malware.
Explicit Confidence 96% · Malwaretech EP 158 Details
“I would write the malware for him and then he would sell it.”
“he had combined it with the banking malware”
WannaCry kill switch domain DISCOVERED_BY Marcus Hutchins
Marcus Hutchins found the unregistered domain in the WannaCry code and registered it.
Explicit Direction flagged Confidence 99% · Malwaretech EP 158 Details
“When I saw this unregistered domain in the WannaCry code, I was like, nice”
“So, I registered it”
EternalBlue EXPLOITS Windows vulnerability
EternalBlue is described as an exploit for a serious vulnerability in Microsoft Windows.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“the NSA found this exploit in Windows, Microsoft Windows”
“they have this really bad vulnerability in Windows”
WannaCry INVOLVES wormable propagation
The WannaCry incident involved unusually rapid wormable propagation across networks.
Derived Confidence 98% · Jack Rhysider EP 158 Details
“Hundreds of networks were spreading it to hundreds more.”
The WannaCry incident involved the WannaCry ransomware outbreak.
Explicit Confidence 99% · Jack Rhysider EP 158 Details
“The ransomware would soon be called WannaCry, and it was hitting tons of hospitals around the UK.”
Malwaretech SAME_AS Marcus Hutchins
MalwareTech is identified as Marcus Hutchins; the speaker says that after his identity was exposed, he was no longer the anonymous MalwareTech and was now Marcus Hutchins.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I’m now Marcus Hutchins”
“I’m MalwareTech and I’m an anonymous security researcher.”