Kaspersky Lab ASSOCIATED_WITH Russia
Jack says Kaspersky Lab is based in Moscow, Russia.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“Kaspersky Lab is based in Moscow, Russia”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Kaspersky Lab ASSOCIATED_WITH Russia
Jack says Kaspersky Lab is based in Moscow, Russia.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“Kaspersky Lab is based in Moscow, Russia”
Carbanak ASSOCIATED_WITH Russia
The episode presents the operators as Russian hackers or people fluent in Russian, so the Russian association is not certain.
Uncertain Confidence 84% · Jack Rhysider EP 35 Details
“Russian hackers or someone fluent in Russian found their way into a Russian bank’s network”
Denis K ASSOCIATED_WITH Ukraine
Jack says Denis K was from Ukraine and was arrested in Spain in connection with the operation.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“A guy named Denis K was arrested in Spain. He was from the Ukraine”
Carbanak ASSOCIATED_WITH Europol
Europol tracked the group and reported a substantially higher estimate of the number of banks attacked and money stolen.
Attributed Confidence 99% · Jack Rhysider EP 35 Details
“Europol was also tracking this group and they had completely different numbers.”
ATM remote-login authentication bypass DISCOVERED_BY Barnaby Jack
Barnaby Jack found a vulnerability that bypassed authentication on an ATM remote login.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“Barnaby found a [00:10:00] vulnerability in the software to let him bypass that authentication altogether”
Carbanak DISCOVERED_BY Jornt v.d. Wiel
Jornt and his team analyzed the malware and named it Carbanak; Jornt is the identified investigator in the episode.
Derived Confidence 86% · Jornt v.d. Wiel EP 35 Details
“Jornt and his team have responded to a lot of banks with the same problem. They have a copy of the malware”
Barnaby Jack EXPLOITS ATM remote-login authentication bypass
Barnaby used the ATM authentication-bypass vulnerability to gain access without authenticating.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“allowing him to get right into the ATM”
Carbanak INITIAL_ACCESS_VIA phishing
The campaign initially entered a bank through a phishing email sent to an employee.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“They send a spare phishing e-mail to an employee at the bank”
Carbanak INVOLVES screen recording
The attackers recorded an employee's screen to learn how the bank's IT and money-transfer systems worked.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“install video recording software on the machine of one of the employees”
Carbanak INVOLVES exploit in patched Word vulnerability
The phishing Word document contained an exploit for a vulnerability that had already been patched.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“that Word document contained an exploit for an already patched vulnerability”
Carbanak INVOLVES ATM remote access
The attackers remotely controlled ATMs through an ATM administration server.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“One other way was to control the ATMs remotely like we saw with the first case.”
Carbanak INVOLVES ATM jackpotting
The attackers used remote ATM administration to dump all the bills from ATMs.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“they just started dumping all the bills out”
Carbanak INVOLVES keylogging
The attackers installed a keylogger to capture administrator passwords and other keystrokes.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“The hackers first installed a key logger on this person’s computer to record every keystroke”
Carbanak INVOLVES privilege escalation
The attackers attempted to elevate privileges by obtaining administrator passwords.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“the next goal would be to elevate their privileges and get access to the domain controller”
Carbanak INVOLVES lateral movement
After obtaining one administrator password, the attackers reused it on other servers and reached the domain controller.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“Now that they have the admin password to one of the computers they’ll try to use that password on another server.”
The campaign was named Carbanak after investigators analyzed the malware used in the operation.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“At this point they decided to give this malware a name and they called it Carbanak.”
Jornt v.d. Wiel MEMBER_OF Kaspersky Lab
Jornt identifies himself as a security researcher within Kaspersky Lab.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“My name is Jornt v.d. Wiel. I’m a security researcher within the Kaspersky Lab.”
Dade says the film Hackers inspired him to get into computers and influenced his hacker handle.
Explicit Confidence 99% · Dade EP 35 Details
“I picked my hacker handle because of that movie. It’s what inspired me to get into computers in the first place.”
Dade REFERENCES Exploding the Phone
Dade says he is reading Exploding the Phone, a history of phone phreaking.
Explicit Confidence 99% · Dade EP 35 Details
“I’m reading Exploding the Phone. It’s about phone phreaking, kind of the history of it.”
The campaign later branched out to countries including China.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“it did start to branch out to various other countries like Spain and China”
The campaign later branched out to countries including Spain.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“it did start to branch out to various other countries like Spain and China”
The episode says most bank robberies associated with the group occurred in Ukraine and Russia.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“most bank robberies occurred in Ukraine and Russia”
The episode says most bank robberies associated with the group occurred in Ukraine and Russia.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“most bank robberies occurred in Ukraine and Russia”
Carbanak USES Cobalt Strike
After Carbanak signatures became known, the attackers switched to the off-the-shelf tool Cobalt Strike.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike”
One cash-out method was entering data directly into the Swift system to transfer money overseas.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“One way was to enter data directly into the Swift system and transfer money overseas.”