Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
The Washington Post was credited with reporting before the official announcement that NotPetya was carried out by the GRU.
Attributed Confidence 90% · Andy Greenberg EP 54 Details
“the Washington Post who, in a story before that announcement, said simply that NotPetya was carried out by the GRU.”
Andy Greenberg AUTHORED Sandworm
Andy Greenberg says he is the author of the book Sandworm.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“I’m Andy Greenberg and I’m a senior writer for Wired Magazine and I’m the author of this book, Sandworm.”
Mimikatz DEVELOPED_BY Benjamin Delpy
Benjamin Delpy built Mimikatz to extract usernames and passwords from memory.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“He built a tool to extract this username and password to display it to anyone who wants to see it. That tool he made is called Mimikatz”
EternalBlue EXPLOITS SMB vulnerability
EternalBlue exploited a vulnerability in the Server Message Block function.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“EternalBlue which exploited a vulnerability in a Windows function called Server Message Block”
NotPetya INVOLVES EternalBlue
The episode describes EternalBlue being used by the NotPetya worm to spread to computers without stolen passwords.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“if it couldn’t login like that, it would then try to use EternalBlue to see if that system was unpatched and exploit it that way”
NotPetya INVOLVES supply-chain compromise
The incident used a supply-chain compromise involving the MeDoc software update mechanism.
Derived Confidence 96% · Andy Greenberg EP 54 Details
“they hijacked MeDoc’s update mechanism to push out their own malware”
Sandworm POSSIBLY_SAME_AS Fancy Bear
The episode presents Sandworm and Fancy Bear as possibly the same group, but explicitly says this is not known.
Uncertain Confidence 98% · Jack Rhysider EP 54 Details
“It might be the same group as Fancy Bear. We don’t know.”
Incident responders and security researchers characterized NotPetya as a destructive wiper posing as ransomware rather than genuine ransomware.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“It was a destructive worm posing as ransomware.”
“security researchers were suggesting that this isn’t a ransomware; it’s a wiper”
NotPetya TARGETS Linkos Group
The attackers selected Linkos Group and its MeDoc update infrastructure as the initial point for targeting Ukraine.
Explicit Confidence 96% · Jack Rhysider EP 54 Details
“They ultimately chose to target a small company called Linkos Group.”
NotPetya infected and severely disrupted Maersk's global network and operations.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“That was all that it took for Maersk’s entire global network to be infected.”
Merck was among the multinational companies infected by NotPetya.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“That included FedEx, Maersk, the world’s largest [00:20:00] shipping firm, Merck”
The stated target was Ukraine, including its businesses and government agencies, with the goal of taking down as many Ukrainian computers as possible.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“the target of this attack was Ukraine and the goal was to take out as many computers as possible in Ukraine; businesses, government agencies, doesn’t matter.”
FedEx was among the western companies hit by NotPetya.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“That included FedEx, Maersk, the world’s largest [00:20:00] shipping firm, Merck”
NotPetya TARGETS Oschadbank
NotPetya hit approximately ninety percent of Oschadbank's computers and shut down its systems.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“Around ninety percent of all of the computers in Oschadbank had been hit with this mysterious ransomware worm.”
The episode says the hackers used Mimikatz to obtain credentials and help the worm spread through networks.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“the hackers used a tool called Mimikatz”
NotPetya USES EternalBlue
The worm used EternalBlue as an additional way to enter unpatched computers.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“another tool was added to this worm, something called EternalBlue”
NotPetya was distributed by hijacking MeDoc's update mechanism and pushing malware through it.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“they hijacked MeDoc’s update mechanism to push out their own malware. Everyone everywhere in the world who had MeDoc installed suddenly has NotPetya”
NotPetya USES ransomware
The episode says ransomware was used as the destructive mechanism, even though the attackers were not believed to be seeking money.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“Their goal was to destroy computers and ransomware was just the perfect tool to do that.”
NotPetya was initially thought to be Petya, but further research identified it as a new strain; the name NotPetya stuck.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“It was originally thought to be Petya but some additional research went into it and found this is a new strain. It was not Petya.”
NoirNet Diaries DEVELOPED_BY Jack Rhysider
Jack states that he makes the show.
Explicit Confidence 98% · Jack Rhysider EP 55 Details
“This show is made by me”
NoirNet Diaries REFERENCES Jeremy from Marketing
The episode references the earlier Episode 36 story titled “Jeremy from Marketing.”
Explicit Confidence 99% · Jack Rhysider EP 55 Details
“You might remember him from an earlier episode called Jeremy from Marketing.”
“Look for Episode 36, Jeremy from Marketing.”
Yagix obtains domain credentials from the target's WPA2 enterprise wireless network using Eaphammer.
Explicit Confidence 99% · TinkerSecure EP 55 Details
“He snagged domain creds from their WPA2 enterprise wireless network by using Eaphammer.”
TinkerSecure USES Proxmark
TinkerSecure uses a Proxmark to replay an access credential at the CISO office door.
Explicit Confidence 99% · TinkerSecure EP 55 Details
“The Proxmark changed from sniffing to replaying.”
TinkerSecure USES Tailgating
TinkerSecure gains entry by following employees through secured doors.
Derived Confidence 99% · TinkerSecure EP 55 Details
“her friend held the door open for me. I smiled and said thank you, and walked into the secured area”
TinkerSecure USES badge cloning
TinkerSecure uses badge replay/cloning to open a secured door.
Derived Confidence 94% · TinkerSecure EP 55 Details
“I waved my bag by the badge reader by the door and heard it click open.”