Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Mt. Gox shutdown and bankruptcy INVOLVES Mt. Gox
The incident is the shutdown and bankruptcy of Mt. Gox after the exchange halted withdrawals and closed.
Explicit Confidence 99% · Jack Rhysider EP 9 Details
“a few weeks later Mt. Gox, the largest Bitcoin exchange on the market, shut down entirely.”
Mt. Gox shutdown and bankruptcy INVOLVES Bitcoin
The bankruptcy filing stated that Mt. Gox had lost approximately 850,000 Bitcoins, later revised after another wallet was found.
Explicit Confidence 99% · Jack Rhysider EP 9 Details
“At the end of February Mt. Gox had filed for bankruptcy in Tokyo, stating they had lost 850,000 Bitcoins”
Virtual machine wallet loss INVOLVES Bitomat
Bitomat accidentally destroyed its Bitcoin holdings after a wallet in a virtual machine was apparently wiped.
Explicit Confidence 98% · Kim Nilsson EP 9 Details
“there was this other exchange in Poland called Bitomat that accidentally destroyed their own Bitcoin holdings.”
Mt. Gox hot-wallet theft INVOLVES Bitcoin
The hot-wallet theft siphoned approximately 650,000 Bitcoins from Mt. Gox.
Explicit Confidence 99% · Jack Rhysider EP 9 Details
“the thief had been able to siphon 650,000 Bitcoins from Mt. Gox.”
Jed McCaleb MEMBER_OF Mt. Gox
Jed was likely the person running Mt. Gox at the time, though Jack presents this as likely rather than certain.
Uncertain Confidence 82% · Jack Rhysider EP 9 Details
“Which was likely ran by a single person at the time, Jed McCaleb.”
Mark Karpelès MEMBER_OF Mt. Gox
Mark Karpelès took over ownership and ran Mt. Gox from Tokyo.
Explicit Confidence 99% · Jack Rhysider EP 9 Details
“Mark Karpelès is now running Mt. Gox from Tokyo, Japan. All ownership is now transferred to him”
Mt. Gox USES Mt. Gox cold wallet
Mt. Gox kept some Bitcoin in an offline cold wallet in a safer location.
Explicit Confidence 96% · Jack Rhysider EP 9 Details
“This differs from a cold wallet, which was not stored on the Mt. Gox servers but in another location in a much safer place.”
Mark Karpelès USES Willy Bot
Mark was running an internal trading bot called Willy Bot.
Explicit Confidence 99% · Jack Rhysider EP 9 Details
“This trading bot he was running was called the Willy Bot”
Mt. Gox USES Liberty Reserve
Mt. Gox used Liberty Reserve to transfer money between users through a service tied to its back end.
Explicit Confidence 99% · Jack Rhysider EP 9 Details
“Liberty Reserve was a company Mt. Gox used to transfer money from one person to another.”
Mt. Gox USES Mt. Gox hot wallet
Mt. Gox used a hot wallet on its servers for daily operational trades.
Explicit Confidence 99% · Jack Rhysider EP 9 Details
“The hot wallet is a Bitcoin wallet Mt. Gox used to conduct daily operational trades.”
Known vulnerability AFFECTS Apache Tomcat
The transcript links the unpatched Apache Tomcat web server with exploitable vulnerabilities, but does not specify a particular vulnerability.
Derived Confidence 80% · Jack Rhysider EP 10 Details
“the web server was not fully patched, which means the team can use a known vulnerability to access it”
“Apache Tomcat running on it”
Known exploit AFFECTS Apache Tomcat
The known exploit is directed at an internet-facing web server running Apache Tomcat; the exact vulnerability is not identified.
Derived Confidence 78% · Nsa EP 10 Details
“a web server that potentially has vulnerabilities I can exploit”
“like Apache Tomcat running on it”
Implant AFFECTS Windows 2012
The implant caused visible, abnormal Windows behavior after the administrator upgraded to a newer operating-system version; the exact newer version is not stated.
Derived Confidence 68% · Nsa EP 10 Details
“the implant worked from the extent of it went down, installed where it should have, and began operating as expected. The problem was that it wasn’t playing well with the newer version of Windows”
Nation State Actor ASSOCIATED_WITH Central Intelligence Agency
Nation State Actors are described as hacking groups operating inside government agencies; the CIA is given as an example of a U.S. intelligence agency.
Explicit Confidence 82% · Jack Rhysider EP 10 Details
“the hacking groups that are inside government agencies, otherwise known as Nation State Actors”
“The US has the Central Intelligence Agency and the National Security Agency and others.”
Nation State Actor ASSOCIATED_WITH National Security Agency
Nation State Actors are described as hacking groups operating inside government agencies; the NSA is given as an example of a U.S. intelligence agency.
Explicit Confidence 82% · Jack Rhysider EP 10 Details
“the hacking groups that are inside government agencies, otherwise known as Nation State Actors”
“The US has the Central Intelligence Agency and the National Security Agency and others.”
Nation State Actor TARGETS Peruvian Ministry of Foreign Affairs
The Peruvian Ministry of Foreign Affairs is presented as a random example target; Jack explicitly says the actual target will remain anonymous.
Uncertain Confidence 93% · Jack Rhysider EP 10 Details
“for this story, let’s pick a random country to use as an example target”
“Let’s go with the Peruvian Ministry of Foreign Affairs.”
“The actual target will remain anonymous.”
Nation State Actor USES Open-source intelligence
The operator uses publicly available information from social networks, search engines, Reddit, and technical forums to map personnel and infrastructure.
Explicit Confidence 99% · Nsa EP 10 Details
“I have a team of people – I have like, fifteen people who do nothing other than spend eight hours a day for six to eight weeks, searching, scouring the internet”
“we had done a month of open-sourced research”
Nation State Actor USES Weaponization
After reconnaissance, the operator derives the tools and exploits to use and obtains operational approval for them.
Explicit Confidence 97% · Jack Rhysider EP 10 Details
“We now move on to Phase Two of the cyber kill chain; weaponization.”
“with those data points, I derive the tools and exploits that I need to use”
Nation State Actor USES Reconnaissance
The operator performs passive reconnaissance and network mapping to identify exposed systems, software, and access vectors.
Explicit Confidence 98% · Nsa EP 10 Details
“now it’s things like passive reconnaissance and mapping”
Nation State Actor USES Known exploit
The operator uses a known exploit against an unpatched, internet-facing web server to gain access.
Explicit Confidence 99% · Nsa EP 10 Details
“I was able to actually use the known exploit to gain the right access to that machine.”
Nation State Actor USES Credential capture
The operator plans to capture an administrator's credentials when the administrator logs into the compromised server.
Explicit Confidence 99% · Nsa EP 10 Details
“I’m probably going to be able to capture his credentials”
Nation State Actor USES Cyber kill chain
The anonymous operator describes planning and conducting the operation through the phases of the cyber kill chain.
Explicit Confidence 96% · Jack Rhysider EP 10 Details
“The cyber kill chain. This describes the different phases of a cyber-attack.”
Nation State Actor USES lateral movement
The operator moves laterally from the compromised web server to the administrator's machine using credentials or an authenticated session.
Explicit Confidence 99% · Nsa EP 10 Details
“I’m probably going to be able to float across that authenticated session and move laterally to the admin’s machine.”
“We get the information that we need and move laterally onto his machine”
Nation State Actor USES Command and control
The implant provides remote interactive access to the administrator's computer, which the episode identifies as command and control.
Explicit Confidence 99% · Jack Rhysider EP 10 Details
“we now have the ability to remotely access the network admin’s computer. This is our command and control over the target computer.”
Nation State Actor USES Installation
The operator installs the implant on the target system after moving to the administrator's machine.
Explicit Confidence 99% · Jack Rhysider EP 10 Details
“You just heard the fifth phase of the cyber kill chain; installation. We’ve just installed an implant on the target system.”