Victor used Shodan to find IPs with MySQL's port open while looking for exposed databases.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“he could just scan the internet or use a website like Shodan”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Victor used Shodan to find IPs with MySQL's port open while looking for exposed databases.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“he could just scan the internet or use a website like Shodan”
GDI Foundation USES default credentials
GDI's vulnerability work included finding internet-exposed databases with default credentials.
Explicit Confidence 96% · Jack Rhysider EP 88 Details
“databases just left open with default credentials”
Dutch Institute for Vulnerability Disclosure USES Internet-wide vulnerability scanning
DIVD often scans computers in the Netherlands for vulnerabilities.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“they often scan computers in the Netherlands for vulnerabilities”
Victor USES default credentials
Victor tried default usernames and passwords when checking exposed databases.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“he’ll try default usernames and passwords”
Molerats ASSOCIATED_WITH Hamas
Jack's research leads him to conclude that Molerats is somehow allied with Hamas, but he explicitly says the connection is uncertain.
Uncertain Confidence 72% · Jack Rhysider EP 89 Details
“my conclusion is that Molerats is somehow allied with Hamas.”
“I’m not sure to what degree Molerats might be connected with Hamas, if at all.”
Jack says circumstantial evidence indicates that Israel, along with the United States, was behind Stuxnet; the attribution is not presented as certain.
Uncertain Confidence 75% · Jack Rhysider EP 89 Details
“the circumstantial evidence shows that the US and Israel were behind this attack.”
Assaf assesses with moderate to high confidence that Molerats was likely behind the campaign in which Spark was discovered; attribution is hedged.
Uncertain Confidence 82% · Assaf Dahan EP 89 Details
“you can say that with, I don’t know, moderate to high confidence that it’s likely Molerats who is behind it.”
in-memory graph processing DEVELOPED_BY Cybereason
Lior describes in-memory graph processing as the technology built as the secret behind Cybereason.
Explicit Confidence 98% · Lior Div EP 89 Details
“This is a in-memory graph processing technology, that this is kind of the secrets behind Cybereason.”
Malop DEVELOPED_BY Cybereason
Lior says Cybereason invented the Malop, or malicious operation, approach.
Explicit Confidence 99% · Lior Div EP 89 Details
“Basically, we invented the new method and the method is operation-centric. We call it the Malop, the malicious operation approach.”
Lior Div MEMBER_OF Cybereason
Lior identifies himself as the CEO and co-founder of Cybereason.
Explicit Confidence 99% · Lior Div EP 89 Details
“I’m Lior Div, the CEO and co-founder of Cybereason.”
Lior says he was assigned to and served in Unit 8200 for six years.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“Lior was assigned to work in Unit 8200.”
“After six years in the army, I went to the university.”
Assaf Dahan MEMBER_OF Nocturnus
Assaf says he heads the Nocturnus Threat Research Team at Cybereason.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“I am heading the Nocturnus Threat Research Team at Cybereason.”
Nocturnus PART_OF Cybereason
Nocturnus is described as a team inside Cybereason.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“There’s this team inside Cybereason which is called Nocturnus.”
Molerats SAME_AS Gaza Cyber Gang
Jack reports that FireEye calls the group Molerats while Kaspersky calls the same group the Gaza Cyber Gang.
Attributed Confidence 93% · Jack Rhysider EP 89 Details
“FireEye calls this group Molerats but Kaspersky calls this same group the Gaza Cyber Gang.”
Molerats TARGETS Palestinian Authority
Assaf says the group targeted political figures within the Palestinian Authority.
Explicit Confidence 98% · Assaf Dahan EP 89 Details
“they targeted political figures within the Palestinian authority”
Jack describes Stuxnet as attacking an Iranian nuclear enrichment facility.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“this was an attack on an Iranian nuclear enrichment facility in order to thwart their enrichment process.”
Jack says reports show Molerats targeting Fatah but not members of Hamas.
Attributed Confidence 91% · Jack Rhysider EP 89 Details
“they do target Fatah.”
The episode describes Molerats as mostly targeting people in Palestine and Israel, including political figures.
Explicit Confidence 96% · Jack Rhysider EP 89 Details
“They have mostly targeted people in Palestine and Israel”
Assaf says the targeted Palestinian Authority figures were associated with Fatah, and that the group targets political figures and entities in the region.
Explicit Confidence 96% · Assaf Dahan EP 89 Details
“political figures within the Palestinian authority that associated with Fatah”
The Stuxnet attack is described as targeting Iran's nuclear enrichment facility.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“this was an attack on an Iranian nuclear enrichment facility”
SharpStage USES Data exfiltration
SharpStage uses Dropbox as its method for exfiltrating data.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“the exfiltration method is using a Dropbox client”
Spark USES Data exfiltration
Spark can be used to steal and harvest information from a victim endpoint.
Explicit Confidence 96% · Assaf Dahan EP 89 Details
“They can run different commands, they can use it to steal information”
“basically harvest any information.”
DropBook USES Command and control
DropBook implements a command-and-control channel using fake Facebook accounts.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“they actually implemented a C2 communication channel using Facebook fake accounts”
Molerats' campaigns are described as sending targeted phishing emails and documents to victims.
Derived Confidence 97% · Assaf Dahan EP 89 Details
“the operators sent a phishing PDF to their victims.”
“specific individuals were sent these phishing e-mails”
Cybereason USES in-memory graph processing
Cybereason collects endpoint data and analyzes it in real time using graph processing.
Explicit Confidence 99% · Lior Div EP 89 Details
“over there we’re running the graph processing in real time.”