Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Las Vegas Sands cyber-attack INVOLVES persistence
The attackers established a persistent connection so they could retain access if the compromised password changed.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They gave themselves a persistent connection to it in case that password was to change”
Las Vegas Sands cyber-attack INVOLVES brute-force password attack
The attackers attempted hundreds of password combinations against VPN users in a brute-force password attack.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They tried hundreds and hundreds of password combinations to try to get into this VPN”
Las Vegas Sands cyber-attack INVOLVES Data exfiltration
During the attack, sensitive customer, guest, staff, and gambler data was compressed and downloaded.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“sensitive files were being compressed and downloaded”
“Social security numbers were stolen, drivers license details were stolen”
Las Vegas Sands cyber-attack INVOLVES Mimikatz
The attackers used Mimikatz on a web development server to obtain usernames and passwords.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They used a tool called Mimikatz”
“these hackers ran Mimikatz on this web development server”
The Venetian PART_OF Las Vegas Sands
The Venetian is described as being owned by Las Vegas Sands.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“LVS is the company that owns The Venetian and Palazzo in Vegas”
Sands Bethlehem PART_OF Las Vegas Sands
Sands Bethlehem is described as one of the Sands properties associated with Las Vegas Sands.
Explicit Confidence 96% · Jack Rhysider EP 37 Details
“another Sands Casino Resort in Bethlehem”
“One of Sheldon’s properties is called Sands Bethlehem”
Iranian government TARGETS Las Vegas Sands
The Iranian government is attributed with targeting Las Vegas Sands in the destructive cyber-attack, according to James Clapper's Senate testimony.
Attributed Confidence 96% · James Clapper EP 37 Details
“the Iranian attack against the Las Vegas Sands Casino Corporation”
Electronic Frontier Foundation ASSOCIATED_WITH Lookout
EFF and Lookout collaborated on investigating the mobile malware and the broader campaign.
Explicit Confidence 99% · Jack Rhysider EP 38 Details
“The team at EFF and the team at Lookout, they team up”
Operation Manul ASSOCIATED_WITH Kazakhstan
The researchers believed the people targeting Respublika and Irina were likely acting on behalf of Kazakhstan, but described the evidence as circumstantial.
Uncertain Confidence 88% · Cooper Quinton EP 38 Details
“were likely doing this on behalf of the government of Kazakhstan”
“we have a pretty good link to Kazakhstan although no – it’s all circumstantial evidence.”
Dark Caracal ASSOCIATED_WITH Ogero Telecom
The campaign's command-and-control administrator IP addresses were all associated with Ogero Telecom, which is owned by the Lebanese government.
Explicit Confidence 94% · Cooper Quinton EP 38 Details
“they were all from Ogero Telecom which is owned by the government of Lebanon.”
CrossRAT ASSOCIATED_WITH Prince Ali
CrossRAT shared a communication scheme with Bandook and Dark Caracal; because Prince Ali wrote Bandook, the researchers said this looked like a possible common authorship clue, not a confirmed attribution.
Uncertain Confidence 84% · Cooper Quinton EP 38 Details
“It looks like the same person wrote all of this malware and we know that Prince Ali wrote Bandook.”
Dark Caracal ASSOCIATED_WITH General Directorate of General Security
The campaign was strongly, but not conclusively, associated with Lebanon's General Directorate of General Security because test devices and administrator activity pointed to its headquarters.
Uncertain Confidence 90% · Jack Rhysider EP 38 Details
“While it’s not a smoking gun, it strongly suggests that the Lebanese government is behind all of this hacking.”
“It’s the headquarters of Lebanon’s General Directorate of General Security.”
Dark Caracal ASSOCIATED_WITH Prince Ali
Dark Caracal shared a command-and-control communication scheme with Bandook and CrossRAT, suggesting but not proving a connection to Prince Ali.
Uncertain Confidence 84% · Cooper Quinton EP 38 Details
“CrossRAT, Bandook, [00:50:00] and the Dark Caracal mobile malware all use the same scheme to communicate with the command and control servers.”
Dark Caracal ASSOCIATED_WITH Prince Ali
The researchers considered Prince Ali a possible common thread because he wrote Bandook and was Lebanese, but they did not establish that he operated the entire campaign.
Uncertain Confidence 82% · Jack Rhysider EP 38 Details
“I’m starting to think Prince Ali is the common thread to all this.”
Bandook DEVELOPED_BY Prince Ali
Bandook was developed by a person using the name Prince Ali.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“Bandook was developed by a guy who goes by the name Prince Ali.”
Lookout researchers found Pallas while searching their mobile-malware database for samples communicating with Operation Manul domains.
Explicit Confidence 96% · Cooper Quinton EP 38 Details
“after a little while they find some malware which is talking to the same domains that we had discovered”
Operation Manul INITIAL_ACCESS_VIA spear phishing
The campaign initially targeted Irina, her brother, and associates with spear-phishing emails carrying malicious attachments.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“she and her brother who is also an editor started receiving spear phishing e-mails”
Operation Manul INVOLVES jRat
Malicious attachments used in the campaign downloaded jRat.
Explicit Confidence 99% · Jack Rhysider EP 38 Details
“when you open these attachments it will go download a piece of malware called jRat.”
Operation Manul INVOLVES command and control server
The campaign used command-and-control servers to communicate with the malware and receive stolen files.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“We started looking into the malware and we find the command and control servers.”
Operation Manul INVOLVES Respublika
The campaign involved targeting people connected with Respublika and its reporting.
Explicit Confidence 95% · Cooper Quinton EP 38 Details
“the people who were going after Respublika and after Irina Petrushova”
Operation Manul INVOLVES Bandook
The campaign also used Bandook as a second piece of malware.
Explicit Confidence 99% · Jack Rhysider EP 38 Details
“a second piece of malware which also was discovered called Bandook.”
Operation Manul INVOLVES Pallas
Lookout found mobile malware communicating with domains associated with Operation Manul and believed it was related to the campaign.
Attributed Confidence 95% · Cooper Quinton EP 38 Details
“We think that it’s related to Operation Manul.”
Dark Caracal INVOLVES Dark Caracal
The Dark Caracal campaign involved mobile malware that the researchers called Dark Caracal.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“When we looked at the mobile malware which we called Dark Caracal”
Dark Caracal INVOLVES Trojanized applications
The campaign used Trojanized applications that remained functional while spying on victims in the background.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“these were all, in addition to being spyware, working versions of the app still.”
Operation Manul INVOLVES Irina Petrushova
Operation Manul began in the context of EFF representing Irina Petrushova, who was targeted after reporting on Kazakhstan's government.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“Operation Manul started when the EFF was representing a woman named Irina Petrushova”