The WannaCry incident involved the WanaCrypt/WannaCry ransomware.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware which was encrypting the files was called WanaCrypt”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
The WannaCry incident involved the WanaCrypt/WannaCry ransomware.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware which was encrypting the files was called WanaCrypt”
Bureau 121 PART_OF Reconnaissance General Bureau
Bureau 121 is described as a branch within North Korea's Reconnaissance General Bureau.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“within the Reconnaissance General Bureau is another branch called Bureau 121”
Kim Hyon Woo POSSIBLY_SAME_AS Park Jin Hyok
The DOJ reportedly had enough evidence to believe Kim Hyon Woo was an alias of Park Jin Hyok; the episode therefore presents the identity link as an evidentiary conclusion rather than an independently certain fact.
Uncertain Confidence 96% · Jack Rhysider EP 73 Details
“The DOJ saw enough evidence to believe that Kim Hyon Woo was an alias of Park Jin Hyok”
Lazarus Group TARGETS South Korea
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target South Korea.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea”
Lazarus Group TARGETS United States
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target the United States.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea, Japan, and the United States”
WannaCry TARGETS National Health Service
The NHS was among the major networks affected by the worldwide ransomware campaign.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“The NHS is one of the bigger networks to be hit by this”
Lazarus Group TARGETS Japan
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target Japan.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea, Japan”
WannaCry USES EternalBlue
WannaCry used the EternalBlue exploit.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“The exploit this malware was using was EternalBlue”
WannaCry USES DoublePulsar
Matt Suiche said the malware was using DoublePulsar together with EternalBlue.
Explicit Confidence 98% · Matt Suiche EP 73 Details
“it was using the DoublePulsar on EternalBlue”
WannaCry USES kill switch
WannaCry checked a specific URL and stopped running when the URL was active, implementing a kill switch.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“This is called a kill switch”
WannaCry USES lateral movement
After infecting one computer, WannaCry attempted to spread to other computers inside the local network.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“it would then look to try to infect every other computer in that local network”
WannaCry USES ransomware
WannaCry encrypts files and demands payment to unlock them, functioning as ransomware.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“This is a typical ransomware message”
NotPetya USES EternalBlue
The episode says NotPetya also used EternalBlue.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“in June, is when NotPetya hit Ukraine which also used EternalBlue”
WannaCry USES self-propagating worm
WannaCry was a self-propagating worm that attempted to infect other computers on a local network.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware was a self-propagating worm”
Mikko Hyppönen ASSOCIATED_WITH Hyppönen Law
The Hyppönen Law is explicitly associated with Mikko and named after him, although Mikko says he did not originally coin it as a law.
Explicit Confidence 98% · Jack Rhysider EP 74 Details
“There’s a law named after you”
“there’s a Wikipedia page for the Hyppönen Law”
Pot odds calculator CONTAINS Remote access Trojan
F-Secure found that a pot-odds calculator installed by a poker player contained a remote access Trojan.
Explicit Confidence 99% · Mikko Hyppönen EP 74 Details
“there was this tool for calculating pot odds which contained, again, a remote access Trojan.”
Winvir DISCOVERED_BY Mikko Hyppönen
Mikko says he and a coder named Ismo found what they determined was the first Windows virus and named it Winvir.
Explicit Confidence 96% · Mikko Hyppönen EP 74 Details
“me and Ismo, one of our coders at the time, spent a couple of days trying to figure out this sample.”
“It turned out to be the very first Windows virus in history. Well, we named it.”
Mikko Hyppönen MEMBER_OF Data Fellows
Mikko says he joined Data Fellows in 1991 as employee number six.
Explicit Confidence 99% · Mikko Hyppönen EP 74 Details
“I joined a company called Data Fellows in 1991 as employee number six.”
Mikko Hyppönen MEMBER_OF F-Secure
Mikko states that he is the chief research officer of F-Secure.
Explicit Confidence 99% · Mikko Hyppönen EP 74 Details
“I am the chief research officer for F-Secure Corporation”
Mikko Hyppönen MENTIONS Brain
Mikko discusses Brain and says he analyzed Brain.A when he began professionally analyzing malware.
Explicit Confidence 98% · Mikko Hyppönen EP 74 Details
“I did go through the Brain.A code as well when I started professionally doing malware analyzes.”
Malware Museum PART_OF Internet Archive
Jack directs listeners to the Malware Museum at the Internet Archive.
Explicit Direction flagged Confidence 91% · Mikko Hyppönen EP 74 Details
“visiting the Malware Museum at the internet archive”
Data Fellows SAME_AS F-Secure
Mikko says Data Fellows was renamed F-Secure in 1999 and that it is the same company.
Explicit Confidence 99% · Mikko Hyppönen EP 74 Details
“The company isn’t called Data Fellows anymore because we renamed the company to F-Secure in 1999”
“But yeah, it is the same company.”
Whale USES Polymorphic malware
Mikko says Whale used metamorphic or polymorphic algorithms and rewrote itself when replicating.
Explicit Confidence 99% · Mikko Hyppönen EP 74 Details
“These are viruses which would use metamorphic or polymorphic algorithms, including Whale.”
“Every time the Whale malware would replicate to a new file, it would rewrite itself.”
Sobig USES Command and control
Sobig.F infected computers contacted command-and-control servers controlled by the malware author for instructions.
Explicit Confidence 99% · Mikko Hyppönen EP 74 Details
“every single infected computer would contact ten different servers. These would be command and control servers controlled by the malware author.”
F-Secure USES WHOIS records
F-Secure researchers use WHOIS records, including historical WHOIS records, to help identify people involved with malware.
Explicit Confidence 96% · Mikko Hyppönen EP 74 Details
“one of the most typical ways we have been able to figure out who’s involved with a piece of malware is WHOIS records.”