Litecoin-mining malware USES Command and control
Int80 says the malware's command and control was hosted on a VPS.
Explicit Confidence 99% · Int80 EP 78 Details
“the C2 was at some hosting company”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Litecoin-mining malware USES Command and control
Int80 says the malware's command and control was hosted on a VPS.
Explicit Confidence 99% · Int80 EP 78 Details
“the C2 was at some hosting company”
Int80 USES Windows API
Int80 says he learned the Windows API to write programs that could kick people offline.
Explicit Confidence 99% · Int80 EP 78 Details
“learning Visual Basic and the Windows API so that I could write my own punters”
YTCracker USES Website defacement
YTCracker describes replacing or modifying website pages as a form of web page defacement.
Explicit Confidence 99% · YTCracker EP 78 Details
“I kind of really liked web page defacement”
Ohm-I USES .NET payloads
Ohm-I describes using .NET payloads while developing a web shell for a penetration test.
Explicit Confidence 99% · Jack Rhysider EP 78 Details
“writing .NET payloads”
YTCracker USES bulletin board system
YTCracker says his first real hack involved accessing a public library bulletin board system.
Explicit Confidence 97% · YTCracker EP 78 Details
“the public library had a bulletin board system”
Litecoin-mining malware USES VPS
Int80 says the malware's C2 was on a VPS in a hosting provider's environment.
Explicit Confidence 99% · Int80 EP 78 Details
“this malware has got its C2 on a VPS in your hosting setup”
Litecoin-mining malware USES Litecoin
The malware mined Litecoin and used a Litecoin mining pool.
Explicit Confidence 99% · Int80 EP 78 Details
“I reached out to the Litecoin mining pool”
YTCracker describes using AOL systems and chatrooms to identify and intimidate users.
Explicit Confidence 96% · YTCracker EP 78 Details
“We were working on defacing keywords. We had access to the CRIS.”
Jack describes the Eggdrop installation as an IRC bot.
Derived Confidence 93% · Jack Rhysider EP 78 Details
“He installed an IRC bot on it”
Litecoin-mining malware USES Dropbox
Int80 says the malware staged files on Dropbox.
Explicit Confidence 99% · Int80 EP 78 Details
“the malware had stages up on Dropbox”
Ohm-I says he wrote a web shell to obtain command-line access and take over a machine.
Explicit Confidence 93% · Jack Rhysider EP 78 Details
“writing .NET payloads and all these other cool things”
Int80 USES black-box assessment
Int80 says his application-security consulting engagements included black-box assessments.
Explicit Confidence 99% · Int80 EP 78 Details
“We would do white box or black box assessments”
Ohm-I says he works on an internal red team performing assessments against Azure product teams.
Explicit Confidence 99% · Jack Rhysider EP 78 Details
“Our job is to perform red team assessments against teams working on Azure products and services.”
YTCracker USES Consumer Resource Information Service
YTCracker says he and others had access to AOL's Consumer Resource Information Service to look up user information.
Explicit Confidence 99% · YTCracker EP 78 Details
“We had access to the CRIS. It was the Consumer Resource Information Service”
YTCracker USES Eggdrop bot
YTCracker says he dropped into a shell on a bulletin board system and turned it into an Eggdrop bot.
Explicit Confidence 99% · YTCracker EP 78 Details
“I found out how to drop into a shell. I turned it into an Eggdrop bot.”
Int80 USES malware analysis
Int80 describes sandboxing malware, picking it apart, and determining what it was doing.
Explicit Confidence 99% · Int80 EP 78 Details
“sandbox it, pick it apart programatically, figure out what it was doing”
Kroll ASSOCIATED_WITH Wirecard AG
Kroll investigators visited Matthew Earl on behalf of Wirecard regarding his research into the company.
Explicit Confidence 98% · Jack Rhysider EP 79 Details
“The two men let him know that they were there on behalf of Wirecard”
Dark Basin ASSOCIATED_WITH BellTroX InfoTech Services
The episode presents circumstantial evidence linking Dark Basin’s phishing activity to BellTroX InfoTech Services, rather than asserting a fully proven operational identity.
Uncertain Confidence 86% · Jack Rhysider EP 79 Details
“He was relieved when the Citizen Lab report came out linking the phishing to BellTroX”
BellTroX InfoTech Services ASSOCIATED_WITH Hack-for-hire
The episode portrays BellTroX as potentially operating as a hack-for-hire or mercenary hacking organization, while retaining some uncertainty about the full scope of its activity.
Uncertain Confidence 88% · Jack Rhysider EP 79 Details
“Was that real activity being Dark Basin a massive hack-for-hire mercenary outfit?”
Dark Basin ASSOCIATED_WITH India
The timing, code, URL-shortener names, logs, and test IP addresses were suggestive of operators working out of India, but the episode notes that the timezone could have been falsified.
Uncertain Confidence 84% · Adam Hulcoop EP 79 Details
“each piece was another little bread crumb suggesting operators working out of India”
ShadowFall Capital Research ASSOCIATED_WITH Wirecard AG
ShadowFall Capital Research investigated Wirecard AG as a potential short-selling target.
Explicit Confidence 98% · Jack Rhysider EP 79 Details
“Back in 2015, Matthew started watching a German payment company called Wirecard AG.”
Jones Day ASSOCIATED_WITH Wirecard AG
Jones Day represented Wirecard and sent Matthew Earl a letter concerning his research and alleged conduct.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“It was from Jones Day, a law firm representing Wirecard.”
Dark Basin DISCOVERED_BY Citizen Lab
Citizen Lab investigated the phishing infrastructure and named the hacking group Dark Basin.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“Dark Basin was what Citizen Lab named this hacking group.”
Sumit Gupta MEMBER_OF BellTroX InfoTech Services
Sumit Gupta was identified as the owner of BellTroX and was also listed as being with the company under the alias Sumit Vishnoi.
Explicit Confidence 98% · John Scott-Railton EP 79 Details
“The owner of BellTroX has been indicted and charged”
“His profile says he’s with BellTroX”
Matthew Earl MEMBER_OF ShadowFall Capital Research
Matthew Earl identifies himself as the managing partner of ShadowFall Capital Research.
Explicit Confidence 99% · Matthew Earl EP 79 Details
“My name is Matthew Earl. I’m the managing partner of ShadowFall Capital Research.”