Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Alberto Yusi Lajud-Pena USES cloned payment card
Alberto's crew encoded stolen card details onto blank cards, creating cloned payment cards for the ATM operation.
Explicit Confidence 98% · Jack Rhysider EP 173 Details
“With this information, you can encode that onto a blank card”
Alberto Yusi Lajud-Pena USES card writer
Alberto and his crew used a card writer to encode stolen debit-card information onto blank cards.
Explicit Confidence 99% · Jack Rhysider EP 173 Details
“they got some blank cards and a writer and started getting ready”
Alberto Yusi Lajud-Pena USES ATM cashing
Alberto became involved in cashing stolen cards at ATMs and organized ATM withdrawals.
Explicit Confidence 99% · Jack Rhysider EP 173 Details
“he had just stumbled into the world of cashers”
“Alberto told Elvis about the cashing”
Alberto Yusi Lajud-Pena USES dark web
Jack says Alberto went online and eventually found his way to the dark web, where he discovered how people made money through crime.
Explicit Confidence 99% · Jack Rhysider EP 173 Details
“he eventually found his way to places that most people never go; the dark web”
Seagate USES ATM cashing
Jack says Seagate used teams around the globe to cash the cards, including Alberto's crew.
Explicit Confidence 98% · Loretta Lynch EP 173 Details
“he wasn’t just getting Alberto to cash them. He had teams all over the globe doing it”
Asnarok AFFECTS Sophos XG Firewall
The Asnarok exploit affected the Sophos XG Firewall.
Explicit Confidence 96% · Andrew Brandt EP 174 Details
“Sophos has a firewall called the XG Firewall”
Volexity ASSOCIATED_WITH Uyghur diaspora support organization
Volexity investigated a customer firewall whose owner operated a charity supporting the Uyghur diaspora.
Explicit Confidence 98% · Andrew Brandt EP 174 Details
“the owners of those firewalls were operating a charity that supports the Uyghur diaspora”
Pacific Rim Campaign ATTRIBUTED_TO Chinese state-sponsored threat actor
The episode attributes the Pacific Rim attack campaign to a Chinese state-sponsored threat actor; Jack presents this as the conclusion after the reported attribution to ABT31.
Attributed Confidence 97% · Jack Rhysider EP 174 Details
“the attack was carried out by ABT31, just a Chinese state-sponsored hacker group”
Cyberoam intrusion ATTRIBUTED_TO Chinese state-sponsored threat actor
The episode connects the earlier Cyberoam source-code theft to the later Chinese state-sponsored Pacific Rim activity, but the connection is presented as an investigative conclusion rather than direct proof in the episode.
Uncertain Confidence 82% · Jack Rhysider EP 174 Details
“This is starting to smell like a nation-state actor is behind this”
Cyberoam intrusion COMPROMISES Cyberoam
The 2018 intrusion compromised Cyberoam's network and enabled attackers to reach systems containing firewall source code.
Explicit Confidence 98% · Jack Rhysider EP 174 Details
“Someone had gotten into Cyberoam and was looking for their source code”
Sophos XG Firewall DEVELOPED_BY Cyberoam
The Cyberoam product became the predecessor/code base for the Sophos XG Firewall.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“the Cyberoam code is the predecessor to the XG Firewall code”
Kernel implant DEVELOPED_BY Sophos
The kernel implant was built by Sophos engineers and distributed only to selected machines of suspected threat actors.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“the security team decides they’re going to build something that they just call the implant”
Sophos developed an in-house kernel implant for covert telemetry and collection from selected threat-actor-controlled firewalls.
Derived Confidence 96% · Craig Jones EP 174 Details
“we developed a kernel implant in-house”
TStark EXPLOITS WebAssembly vulnerability
TStark was associated with exploiting a previously unknown WebAssembly vulnerability that injected an iframe into proxies.
Explicit Confidence 97% · Craig Jones EP 174 Details
“he’s got a completely new injection there, like a new vulnerability in web assembly”
Asnarok EXPLOITS SQL injection
Asnarok exploited a SQL injection vulnerability in the Sophos XG Firewall web interface.
Explicit Confidence 99% · Jack Rhysider EP 174 Details
“the web UI of this firewall had a SQL injection vulnerability in it”
Asnarok INITIAL_ACCESS_VIA SQL injection
The Asnarok incident initially gained access through the SQL injection vulnerability in the firewall's web UI.
Derived Confidence 96% · Jack Rhysider EP 174 Details
“an attacker could enter in some commands there which would glitch out the user input handling mechanism of the firewall and allow the attacker to inject their own commands into the database”
Cyberoam intrusion INVOLVES Intel NUC
The intrusion began with an infected Intel NUC used to drive a sales-office display.
Explicit Confidence 97% · Andrew Brandt EP 174 Details
“that was the first machine that got infected”
Cyberoam intrusion INVOLVES Linux
The initially infected Intel NUC was running Linux.
Explicit Confidence 98% · Andrew Brandt EP 174 Details
“a little Linux computer, and that was the first machine that got infected”
Baja INVOLVES Apache module issue
The Baja attack involved an Apache module issue.
Explicit Confidence 99% · Craig Jones EP 174 Details
“It was an Apache module issue”
Pacific Rim Campaign INVOLVES Baja
Baja was another named attack in the Pacific Rim Campaign.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they give this attack a nickname, Baja”
Asnarok INVOLVES Dutch National High Tech Crime Unit
The Dutch National High-Tech Crime Unit obtained and enabled analysis of the threat actor's C2 server.
Explicit Confidence 99% · Craig Jones EP 174 Details
“the Dutch National High-Tech Crime Unit just jumped on this, and they managed to get hold of this C2 server”
The incident was named Asnarok by the Sophos team.
Explicit Confidence 99% · Craig Jones EP 174 Details
“We called it Asnarok”
The attackers used web shells to obtain direct remote access to Sophos Firewalls.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they’re putting just regular old web shells on the firewalls”
Asnarok INVOLVES National Cyber Security Centre Netherlands
The Netherlands NCSC helped coordinate the response to the threat actor's server.
Explicit Confidence 98% · Craig Jones EP 174 Details
“through the NCSC in the Netherlands — they were kinda an intermediary”
Baja INVOLVES Local privilege escalation
The Baja attack chained the Apache module issue with local privilege escalation.
Explicit Confidence 99% · Craig Jones EP 174 Details
“It was an Apache module issue and it was chained with a local privilege escalation”