RevenueJet USES RTG
RevenueJet's casinos used RTG gambling software for their games.
Explicit Confidence 98% · Jack Rhysider EP 76 Details
“all these sites under Affactive and RevenueJet used gambling software called Rival and RTG for the games.”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
RevenueJet USES RTG
RevenueJet's casinos used RTG gambling software for their games.
Explicit Confidence 98% · Jack Rhysider EP 76 Details
“all these sites under Affactive and RevenueJet used gambling software called Rival and RTG for the games.”
John Doe USES Brute-force attack
The unidentified hacker used a brute-force attack to access an E-Trade video teleconferencing server.
Explicit Confidence 99% · Jack Rhysider EP 76 Details
“the hacker breached E-Trade’s server using a brute force attack to gain access to a video teleconferencing server”
Olympic Destroyer AFFECTS Microsoft Windows
Olympic Destroyer disabled Windows services and rendered Windows-based servers unusable.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“disabling all of their Windows services and shutting the computer down so it couldn’t be rebooted”
Olympic Destroyer AFFECTS Domain controller
The malware repeatedly wiped the Olympic domain controllers.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“they find that as they’re rebuilding domain controllers, for instance, they’re being wiped again by some piece of malware in their system”
Olympic Destroyer ASSOCIATED_WITH Lazarus
Researchers found wiper-code similarities between Olympic Destroyer and malware associated with Lazarus, but the episode presents this as one potentially misleading clue.
Uncertain Confidence 95% · Andy Greenberg EP 77 Details
“There were, for instance, code matches with malware from the North Korean group called Lazarus”
Olympic Destroyer ASSOCIATED_WITH APT3
Intezer reported that part of Olympic Destroyer’s password-stealing code matched APT3, which is described as widely understood to be Chinese.
Attributed Confidence 97% · Andy Greenberg EP 77 Details
“Intezer pointed out that a chunk of the password-stealing code in Olympic Destroyer matched with a different hacker group called APT3”
Olympic Destroyer ASSOCIATED_WITH XData
CrowdStrike found similarities between Olympic Destroyer and the ransomware XData used by Russian hackers.
Attributed Confidence 97% · Andy Greenberg EP 77 Details
“CrowdStrike found similarities in parts of Olympic Destroyer with a piece of ransomware that Russian hackers had used called XData”
Sandworm ASSOCIATED_WITH Unit 74455
The episode says the Mueller Report identified Unit 74455 as Sandworm; this is presented as the working identification of the group.
Attributed Confidence 98% · Jack Rhysider EP 77 Details
“it was the first time we learned that Unit 74455 was Sandworm”
Olympic Destroyer ATTRIBUTED_TO Russia
The DOJ indictment attributed the Olympic sabotage to officers of Russia’s military intelligence unit 74455.
Attributed Confidence 99% · Doj EP 77 Details
“The defendants in this case were all members of the military unit 74455 of the Russia main intelligence directorate, known as the GRU.”
Olympic Destroyer ATTRIBUTED_TO Sandworm
The episode ultimately identifies Sandworm as the group responsible for the Olympic attack, while earlier forensic clues were deliberately deceptive.
Attributed Confidence 98% · Jack Rhysider EP 77 Details
“this was the same group that conducted NotPetya, one of the most extreme cyber-attacks the world has ever seen. This was the hacking group known as Sandworm.”
Andy Greenberg AUTHORED Sandworm
Andy Greenberg says he is the author of Sandworm, which contains this story.
Explicit Confidence 99% · Andy Greenberg EP 77 Details
“I’m still the author of Sandworm because this is a story from Sandworm.”
Olympic Destroyer DISCOVERED_BY Igor Sumenkov
Igor Sumenkov identified that the apparent Lazarus Rich Header had been forged.
Explicit Confidence 97% · Andy Greenberg EP 77 Details
“What Igor Sumenkov had found though was that this means someone was trying to make it look like North Korea”
Olympic Destroyer DISCOVERED_BY AhnLab
AhnLab helped isolate the malware and create a signature for it.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“with the help of this Korean security company AhnLab – isolate and create a signature for this automated piece of malware”
Olympic Destroyer DISCOVERED_BY Cisco Talos
Cisco Talos analyzed winlogon.exe and assigned it the name Olympic Destroyer.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“Cisco Talos analyzed winlogon.exe, that malicious file that wiped the computers”
Olympic Destroyer INITIAL_ACCESS_VIA phishing
The initial infection appears to have begun with phishing emails containing malicious Word documents.
Explicit Confidence 99% · Jack Rhysider EP 77 Details
“the initial infection of the Olympic network began with a phishing e-mail”
Olympic Destroyer INVOLVES winlogon.exe
The Olympic attack involved the malicious file winlogon.exe, which repeatedly wiped systems.
Explicit Confidence 99% · Andy Greenberg EP 77 Details
“they’re being wiped again by some piece of malware in their system. They are able to figure out that it’s this one malicious file called winlogon.exe.”
Olympic Destroyer INVOLVES false flag
The attack involved numerous false flags and clues pointing toward different countries.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“the hackers, instead of trying to simply cover their tracks, they had built-in tracks pointing in every direction at once”
Unit 74455 PART_OF GRU
Unit 74455 is described as a unit of the GRU, Russia’s main intelligence directorate.
Explicit Confidence 99% · Doj EP 77 Details
“military unit 74455 of the Russia main intelligence directorate, known as the GRU”
winlogon.exe SAME_AS Olympic Destroyer
Cisco Talos named the malicious winlogon.exe worm Olympic Destroyer.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“it was Talos that gave this worm a name; Olympic Destroyer.”
Olympic Destroyer TARGETS South Korea
The attack targeted the Winter Olympics in South Korea.
Explicit Confidence 99% · Jack Rhysider EP 77 Details
“the Winter Olympics in 2018 which was in South Korea”
Olympic Destroyer USES lateral movement
The worm used stolen passwords and remote-access features to spread among computers.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“use those stolen passwords with remote access features to spread among computers”
phishing USES Malicious Macro Generator
The phishing documents used macros created with the Malicious Macro Generator.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“these macros were created with a tool called Malicious Macro Generator”
Olympic Destroyer USES wiper
The malware used destructive wiping behavior, deleting data and disabling systems.
Explicit Confidence 96% · Andy Greenberg EP 77 Details
“a component that would use those stolen passwords with remote access features to spread among computers and destroy all of the data on them”
YTCracker explains that WinNuke sent a packet to port 139.
Explicit Confidence 99% · YTCracker EP 78 Details
“you send out a band packet to port 139”
Martin Marietta ASSOCIATED_WITH Lockheed Martin
The episode says Martin Marietta eventually became Lockheed Martin.
Explicit Confidence 94% · YTCracker EP 78 Details
“Martin Marietta, which eventually became Lockheed Martin”