Asnarok INVOLVES sophosfirewallupdate.com
The attack redirected firewalls to sophosfirewallupdate.com for update retrieval.
Explicit Confidence 99% · Craig Jones EP 174 Details
“it was a wget to a domain called sophosfirewallupdate.com”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Asnarok INVOLVES sophosfirewallupdate.com
The attack redirected firewalls to sophosfirewallupdate.com for update retrieval.
Explicit Confidence 99% · Craig Jones EP 174 Details
“it was a wget to a domain called sophosfirewallupdate.com”
Pacific Rim Campaign INVOLVES Asnarok
Asnarok was one of the incidents in the broader Pacific Rim Campaign.
Explicit Confidence 99% · Jack Rhysider EP 174 Details
“they called this whole series of incidents the Pacific Rim Campaign”
Asnarok INVOLVES sophosproductupdate.com
The wider attack infrastructure also used sophosproductupdate.com as an update domain.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“there was sophosfirewallupdate.com and sophosproductupdate.com”
Asnarok INVOLVES Sophos XG Firewall
The Asnarok attack affected publicly exposed Sophos XG Firewalls; the episode says a very large number of devices were compromised.
Explicit Confidence 98% · Andrew Brandt EP 174 Details
“essentially every firewall that was facing the public internet was affected by this bug”
Guan Tianfeng MEMBER_OF Sichuan Silence Information Security Technology
Guan Tianfeng was identified as a researcher at Sichuan Silence Technology Company Ltd.
Explicit Confidence 99% · Craig Jones EP 174 Details
“he was the researcher at this company called Sichuan Silence Technology Company Ltd.”
gbigmau SAME_AS Guan Tianfeng
The episode identifies the actor using the handle gbigmau as Guan Tianfeng.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“His name is Guan Tianfeng”
Pacific Rim Campaign TARGETS China
The episode repeatedly describes the actors and their research infrastructure as being located in China, especially Chengdu; this is not a claim that China itself was the victim target.
Explicit Confidence 86% · Craig Jones EP 174 Details
“we found these multiple companies. One of the simplest ways we actually found it, funnily enough — and this sounds so basic — is that we would look at devices that would be continually going up and down firmware versions. These threat actor devices would constantly put the new, latest firmware on, roll it back, new firmware, roll it back. They’d do this, I don’t know, maybe five or six times a day. Whereas normal firewall operation, it’s like, it’s a new firmware and it’s left. Then in a month it gets new firmware and then it’s left. So, these things just stood out like a sore thumb. So, some of it came really easy to find these threat actors. The more telemetry we had the easier it got. We started to really build a wide assortment of threat actors in China”
TStark USES libxselinux.so
TStark was observed developing and using the libxselinux.so userland rootkit on a threat-actor device.
Explicit Confidence 99% · Craig Jones EP 174 Details
“We found him working on a rootkit at the time. It was called libxselinux.so”
Sophos remotely deployed hot fixes to affected firewalls to close the attack loopholes without requiring reboots.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“They pushed out a hot fix to these firewalls”
Kernel implant USES sinkholing
The implant supported Sophos's broader effort to monitor and investigate malicious infrastructure; the episode separately describes Sophos sinkholing seized domains.
Derived Confidence 68% · Andrew Brandt EP 174 Details
“they wanted to sinkhole the domains and see what was connecting into them”
TStark USES UEFI bootkit
TStark's group was observed experimenting with a UEFI bootkit on a firewall, although the attempt failed and bricked the device.
Uncertain Confidence 92% · Andrew Brandt EP 174 Details
“They were really trying to figure out if they could get this bootkit to run on a firewall”
Sophos USES sinkholing
Sophos used sinkholing after taking control of the malicious update domains to observe connecting systems.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they wanted to sinkhole the domains and see what was connecting into them”
Bayrob ATTRIBUTED_TO Bayrob Group
The episode presents Bayrob as the malware operated by the Bayrob Group, while describing the group as the criminals behind the fraud.
Explicit Confidence 94% · Jack Rhysider EP 175 Details
“the Bayrob malware campaign”
TrueCrypt DEVELOPED_BY Bogden Nicolescu
No claim is made that Nicolescu developed TrueCrypt; rather, the episode says he wrote a separate encryption software layer. This claim is omitted because no catalog entity exists for that custom software.
Bayrob DISCOVERED_BY Liam O’Murchu
Liam received and investigated the malware sample that became Bayrob, discovering how it worked and how the criminals used it.
Explicit Confidence 93% · Liam O’Murchu EP 175 Details
“I got this file that I wanted to analyze”
Bayrob EXPLOITS unencrypted Jabber attachments
The operators’ use of Jabber exposed unencrypted attachments, allowing investigators to extract spreadsheets and screenshots from the network traffic.
Explicit Confidence 94% · Jack Rhysider EP 175 Details
“attachments are not — it doesn’t default to encryption”
Bayrob campaign INVOLVES Bayrob
The Bayrob campaign involved the Bayrob malware.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“the Bayrob malware campaign”
Ryan Macfarlane MEMBER_OF FBI
Ryan Macfarlane says he was a cyber agent when he joined the Bayrob investigation.
Explicit Confidence 98% · Ryan Macfarlane EP 175 Details
“at the time I was a cyber agent”
Eoin Miller MEMBER_OF AOL
Eoin Miller says he worked on AOL’s CERT team.
Explicit Confidence 99% · Eoin Miller EP 175 Details
“I worked on AOL’s cert team from 2011 to 2016”
Brian Levine MEMBER_OF Computer Crime and Intellectual Property Section
Brian Levine identifies himself as the cyber-crime prosecutor at CCIPS.
Explicit Confidence 99% · Brian Levine EP 175 Details
“I was the cyber-crime prosecutor at the Computer Crime and Intellectual Property Section”
Radu Miclaus MEMBER_OF Bayrob Group
Radu Miclaus, also called Minolta and Raduspr, is identified as one of the three main people behind the Bayrob campaign.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“Radu Miclaus, AKA Minolta, AKA Raduspr”
Bogden Nicolescu MEMBER_OF Bayrob Group
Bogden Nicolescu, also called Masterfraud, is identified as one of the three main people behind the Bayrob campaign and as the group’s leader.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“There was Bogden Nicolescu, AKA Masterfraud”
“the head of the group”
Tiberiu Danet MEMBER_OF Bayrob Group
Tiberiu Danet, also called Amightysa, is identified as one of the three main people behind the Bayrob campaign.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“Tiberiu Danet, AKA Amightysa”
Stacy Whittaker MEMBER_OF FBI
Stacy Whittaker identifies herself as a retired FBI agent and describes working as an FBI agent on the Bayrob investigation.
Explicit Confidence 99% · Stacy Whittaker EP 175 Details
“I am now a retired FBI agent”
Liam O’Murchu MEMBER_OF Symantec
Liam O’Murchu says he works with Symantec in its Security Response Department analyzing malware.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“I work with Symantec and I’ve been there since 2004”