Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
WannaCry USES ransomware
WannaCry is described as ransomware that encrypted computers and demanded Bitcoin for recovery.
Explicit Confidence 99% · Jack Rhysider EP 158 Details
“The ransomware would soon be called WannaCry”
“you had to pay Bitcoin to get it unlocked again”
Marcus Hutchins USES malware reverse engineering
Marcus Hutchins says his cybersecurity work specialized in malware reverse engineering.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I mostly specialized in a combination of malware, reverse engineering, and cyber threat intelligence.”
Marcus Hutchins USES cyber threat intelligence
Marcus Hutchins says his cybersecurity work specialized in cyber threat intelligence, including monitoring botnet infrastructure and identifying victims.
Explicit Confidence 98% · Malwaretech EP 158 Details
“I mostly specialized in a combination of malware, reverse engineering, and cyber threat intelligence.”
“our goal was to be on the bad guy’s network and be able to see all the victims of the malware”
WannaCry USES WannaCry kill switch domain
WannaCry checked a domain in its code, and the domain's activation functioned as a kill switch that stopped the malware from spreading.
Explicit Confidence 99% · Malwaretech EP 158 Details
“the domain was a kill switch”
“the malware stops everything it’s doing”
WannaCry USES EternalBlue
The episode describes North Korea picking up the leaked EternalBlue exploit and making ransomware with it; the link between WannaCry and EternalBlue is presented in that account.
Derived Confidence 94% · Malwaretech EP 158 Details
“North Korea pick it up and decide to make ransomware with it”
WannaCry used Bitcoin payments as part of its ransomware operation.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“you had to pay Bitcoin to get it unlocked again”
The prosecution's theory treated the malware as a keylogger because it listened to keystrokes; this is presented as the government's characterization rather than an uncontested technical classification.
Attributed Confidence 78% · Malwaretech EP 158 Details
“malware listens to keystrokes. Like, it’s like a key-logger”
WannaCry USES wormable propagation
WannaCry is described as wormable ransomware that spreads from computer to computer without user action.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I didn’t think anyone had ever made wormable ransomware before.”
“this ransomware spreads from computer to computer, completely unaided.”
Vastaamo cyber attack ATTRIBUTED_TO Ransom Man
The attack was initially attributed through Ransom Man's own claim that he had hacked Vastaamo and possessed its clients' data.
Attributed Confidence 98% · Joe Tidy EP 159 Details
“they were calling themselves Ransom Man and they were saying, I have hacked the Vastaamo psychotherapy center”
Vastaamo cyber attack ATTRIBUTED_TO Julius Kivimaki
Julius Kivimaki became the prime suspect, with investigator Marko Leponen finding evidence pointing toward him; the attribution is presented as investigative suspicion rather than an unqualified fact.
Uncertain Confidence 93% · Joe Tidy EP 159 Details
“this kid or this cyber criminal who was famous when he was a kid, infamous, rather, is probably the prime suspect. The name Julius Kivimaki just keeps coming up”
“the investigator, Marko, was finding actual evidence that was pointing to him”
Joe Tidy AUTHORED Ctrl+Alt+Chaos
Joe Tidy published the book Ctrl+Alt+Chaos.
Explicit Confidence 99% · Jack Rhysider EP 159 Details
“he just published a book called Ctrl+Alt+Chaos”
Vastaamo cyber attack COMPROMISES Vastaamo
The Vastaamo cyber attack compromised Vastaamo and its patient records.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“I have hacked the Vastaamo psychotherapy center”
Vastaamo cyber attack INITIAL_ACCESS_VIA default credentials
According to Ransom Man's forum statement, access to the database was easy because it had no password and used the credentials 'root root'.
Attributed Confidence 95% · Joe Tidy EP 159 Details
“there was no password. It was ‘root root’”
Sony PlayStation Network and Xbox Live DDoS attack INVOLVES DDoS attack
The Sony PlayStation Network and Xbox Live incident was described as a major DDoS attack.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“this amazingly huge and incredible DDOS attack on Sony PlayStation Network and Xbox Live”
Vastaamo cyber attack INVOLVES Ransom Man
Ransom Man is the actor who communicated the ransom demands and disclosed patient records in the incident.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“Ransom Man said, I have been trying to get 400,000 euros”
Vastaamo cyber attack INVOLVES data extortion
The attacker attempted to extort Vastaamo and later its patients by threatening to publish stolen data.
Explicit Confidence 99% · Jack Rhysider EP 159 Details
“all I want is Bitcoin or else I’m gonna release it to the world”
Vastaamo cyber attack INVOLVES bulk data disclosure
The incident involved repeated publication of patient records and an accidental upload containing the data of approximately 33,000 patients.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“he accidentally did was posted his entire home directory and the entire list and all the data from the 33,000 patients”
Vastaamo cyber attack INVOLVES Finnish police
The Finnish police investigated the incident, archived the disclosures, and pursued the attacker.
Explicit Confidence 99% · Jack Rhysider EP 159 Details
“the Finnish police were already very aware of this situation because they were working with Vastaamo”
Vastaamo cyber attack INVOLVES Tor
The attacker used Tor/the darknet to host and distribute the stolen data.
Explicit Confidence 98% · Jack Rhysider EP 159 Details
“he posted it on the darknet on Tor”
Sony PlayStation Network and Xbox Live DDoS attack INVOLVES Lizard Squad
The 2014 attack on Sony PlayStation Network and Xbox Live involved Lizard Squad.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“these teenagers called Lizard Squad”
Vastaamo cyber attack INVOLVES GDPR
The aftermath involved data-protection enforcement and GDPR-related legal proceedings against Vastaamo's CEO.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“Ville Tapio, he would say that the company could have survived if he’d had been allowed to keep operating it and kind of steered the ship through this crisis, but he was dropped very, very quickly as soon as the investigators began poking around. JACK: When Vastaamo got the ransom note from Ransom Man, they called the police, and the police took over the situation. They took over the CEO’s e-mail and they were responding to Ransom Man, posing as the CEO. They were advising Vastaamo how to react to everything, and the police weren’t trying to save the reputation of the company. They were trying to solve the case of who did it, so they had a totally different priority than maybe the Vastaamo leadership. So, the CEO of Vastaamo didn’t have control of the ship in the middle of this crisis. The police did. JOE: Not only had Ransom Man managed to get hold of this data in 2018; someone else somewhere — we don’t know who, we don’t know what happened; they got hold of it in 2019 or they had access to it, and there was still a lot of confusion here about whether or not there was a cover-up. [Music] Tapio denies that vociferously. The IT team that he hired have gone dark. They don’t — they haven’t spoken to anybody. So, we don’t know exactly the nature of that, but the Vastaamo hack, Ransom Man, plus this incident in 2019, it just meant the company was in absolute chaos and crisis, and legal problems as well. You can imagine data protection authorities breathing down their necks. They had fines to pay. Then you’ve just got the fact that there was tens of thousands of people who just could no longer trust the company, and the way they handled it was atrocious. People were turning up at the therapy centers demanding their notes to be handed over, and some of the staff were in tears. It was just utter, utter devastation, and the company collapsed into administration. JACK: The company collapsed. Wow. It’s pretty rare for a company to be damaged so badly from a cyber attack that it can’t recover and has to shut down like this. It’s wild to think that your whole business could come to a catastrophic end all because of a hacker. But all this does make you wonder, whose fault is it for not securing the customers’ data better, and shouldn’t they be held responsible? JOE: Well, Ville Tapio, the CEO, he has been prosecuted for… JACK: Really? JOE: …for failing to protect the data, but he’s appealing that and we don’t know what’s gonna happen with that. JACK: The CEO blames his IT team for failing to protect the data, and he blames the police for how badly the fallout was handled. He says when he called the NBI, the National Bureau of Investigation, they locked him out of all decision-making, and he didn’t even know what was being said in e-mails using his name. Pretty early in the investigation, the NBI filed a criminal complaint against the CEO accusing him of a data protection violation, which led the board to remove him as CEO in the middle of this crisis while people were trying to call 24/7 looking for help. So, the company was leaderless during all this, and not only was he dismissed as the CEO, but the parent company of Vastaamo also sued him, accusing him of failing to protect user data. Ville Tapio, the CEO, was convicted in the District Court of Helsinki for data protection violations under the EU’s General Data Protection Regulations”
Vastaamo cyber attack INVOLVES National Bureau of Investigation
The National Bureau of Investigation became involved in the response and investigation, including locking Ville Tapio out of decision-making according to his account.
Explicit Confidence 97% · Jack Rhysider EP 159 Details
“when he called the NBI, the National Bureau of Investigation, they locked him out of all decision-making”
Joe Tidy says he previously worked at Sky News as a general correspondent.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“before that, I was at Sky News, and I was a general correspondent at Sky News”
Julius Kivimaki MEMBER_OF HTP
Joe Tidy says Kivimaki was part of HTP and was convicted for activity associated with it.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“Then after that you had HTP, which Kivimaki was part of and convicted for”
Julius Kivimaki MEMBER_OF UGNazi
Joe Tidy says Kivimaki was part of UGNazi among other teenage cyber-crime gangs.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“there were other gangs he was part of like Lizard Squad and UGNazi, Isis gang”