Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Newegg data breach TARGETS Newegg
The Newegg data-breach incident targeted Newegg's website and checkout process.
Explicit Confidence 99% · Jonathan Klijnsma EP 52 Details
“it was another breach”
“the hackers were scraping every credit card entered into Newegg’s site”
British Airways data breach TARGETS British Airways
The British Airways data-breach incident targeted British Airways websites and payment systems.
Explicit Confidence 99% · Jonathan Klijnsma EP 52 Details
“they breached BA”
Magecart USES JavaScript
Magecart skimmers are implemented as small pieces of JavaScript loaded into websites.
Explicit Confidence 99% · Jonathan Klijnsma EP 52 Details
“The skimming code is a small piece of JavaScript.”
Magecart USES web skimming
Magecart uses web skimming to steal payment data from online checkout pages.
Explicit Confidence 98% · Jonathan Klijnsma EP 52 Details
“Web skimming is the go-to thing by now if you want to steal credit card data.”
Magecart USES supply-chain compromise
Magecart has used compromised third-party or supply-chain resources to place malicious JavaScript on websites.
Explicit Confidence 97% · Jack Rhysider EP 52 Details
“the hackers were getting this malicious JavaScript into these sites through the supply chain”
Windows event log editing exploit AFFECTS Windows event logs
The exploit can disable logging without creating an event and remove individual Windows events.
Explicit Confidence 97% · Jack Rhysider EP 53 Details
“you can disable logging without an event indicating logging has been turned off”
Windows event log editing exploit AFFECTS Microsoft Windows
The dumped exploit is described as enabling attackers to edit Windows event logs.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“The exploit they dumped means a hacker can edit an event log in Windows”
EternalBlue AFFECTS SMB
EternalBlue is described as remotely accessing Windows computers running SMB.
Explicit Confidence 96% · Jack Rhysider EP 53 Details
“an exploit that can be used to remotely access Windows computers running SMB”
Shadow Brokers ASSOCIATED_WITH Russia
Jack says most signs point to Russia being behind the Shadow Brokers, but explicitly notes that this is not known for certain.
Uncertain Confidence 86% · Jack Rhysider EP 53 Details
“most signs do point to Russia being behind the Shadow Brokers, but we don’t know for certain”
Equation Group ASSOCIATED_WITH Tailored Access Operations
Jack says it is believed that the people doing work for the Equation Group are specifically TAO within the NSA.
Uncertain Confidence 95% · Jack Rhysider EP 53 Details
“it’s believed that whoever is doing work for the Equation Group is specifically TAO within the NSA”
Shadow Brokers leaks ATTRIBUTED_TO Shadow Brokers
The leaks are described as hacking-tool dumps released by the group calling itself Shadow Brokers.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“the Shadow Brokers had leaked NSA hacking tools”
Andy Greenberg AUTHORED Sandworm
Jack says Andy Greenberg wrote the book Sandworm.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“Andy Greenberg from Wired. He just finished writing a new book called Sandworm”
Shadow Brokers leaks CONTAINS EternalBlue
One Shadow Brokers dump contained the EternalBlue exploit.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“This dump contained EternalBlue and EternalRomance, among others”
Shadow Brokers leaks CONTAINS EternalRomance
One Shadow Brokers dump contained the EternalRomance exploit.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“This dump contained EternalBlue and EternalRomance, among others”
COTTONMOUTH DEVELOPED_BY NSA
Jack states that the NSA created the device codenamed COTTONMOUTH.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“the NSA has created a device codenamed COTTONMOUTH”
exploit:cisco_and_fortinet_firewall_vulnerability EXPLOITS Cisco and Fortinet firewall vulnerability
The catalog contains an exploit for a Cisco and Fortinet firewall vulnerability that was previously unknown to those vendors.
Derived Direction flagged Confidence 90% · Jack Rhysider EP 53 Details
“The malware was a specific exploit for Cisco and Fortinet firewalls”
“Both Cisco and Fortinet confirmed this was a vulnerability they were not aware of”
Jake Williams MEMBER_OF Tailored Access Operations
Jack states that Jake had spent about five years in TAO and was a former member.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“Jake had spent almost two decades working in the information community for the government and about five years in TAO”
Shadow Brokers MENTIONS Jake Williams
The Shadow Brokers publicly identified Jake as a former Equation Group member; Jake says they were not guessing and knew his identity.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“you having a big mouth for former Equation Group member”
“they 100% were not guessing at who I was”
Tailored Access Operations PART_OF NSA
TAO is described as a unit within the NSA.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“TAO stands for Tailored Access Operations, TAO. It’s a unit within NSA”
Jack Rhysider REFERENCES Sandworm
Jack recommends Andy Greenberg’s book Sandworm as covering the Shadow Brokers and EternalBlue.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“if you want to check out his book, it’s Sandworm. It’s really good”
Shadow Brokers leaks RELATED_TO Harold Martin III
Jack presents a theory that the Shadow Brokers data could have come from information Harold Martin stole, while emphasizing that there is no good evidence connecting him to the leaks.
Uncertain Confidence 88% · Jack Rhysider EP 53 Details
“The data on the Shadow Broker dumps could have been something that Harold stole”
“there’s no real good evidence that does connect Harold to this whole thing”
SMB vulnerability AFFECTS Server Message Block
The vulnerability EternalBlue exploited was in the Windows Server Message Block function.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“EternalBlue which exploited a vulnerability in a Windows function called Server Message Block”
The episode presents the belief that Sandworm and Fancy Bear were hacking groups working for Russia's GRU, while acknowledging uncertainty about the exact relationship.
Uncertain Confidence 85% · Jack Rhysider EP 54 Details
“what we believe is that both Sandworm and Fancy Bear are hacking groups both working for Russia’s GRU in Moscow.”
NotPetya ATTRIBUTED_TO Sandworm
ESET's forensic evidence tied NotPetya to earlier attacks against Ukraine that had been tied to Sandworm.
Attributed Confidence 91% · Andy Greenberg EP 54 Details
“ESET had started to pull together forensic evidence that tied NotPetya to the earlier waves of attacks against Ukraine”
“Those attacks, in turn, had been tied to this group Sandworm.”
The White House and the other Five Eyes intelligence agencies publicly attributed NotPetya to Russia, specifically saying it was deployed by the Russian military against Ukraine.
Attributed Confidence 99% · Andy Greenberg EP 54 Details
“the White House put out a statement, a very, very short statement that just said yes, NotPetya was the worst cyber-attack in history and it was deployed by the Russian military against Ukraine”
“The US, Canada, New Zealand, Australia, and the UK all simultaneously called out Russia as the perpetrator of NotPetya.”