Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Fox News article: World Bank Under Cyber Siege in Unprecedented Crisis ASSOCIATED_WITH Fox News
The article was a Fox News report about the World Bank intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“a story that ended up getting leaked to Fox News”
“Someone had spoken to a reporter [00:25:00] at Fox News and told them about this incident.”
World Bank network intrusion ATTRIBUTED_TO China
The attack was not identified with certainty, but clues and some Mandiant analysis suggested it came from China or a Chinese asset.
Uncertain Confidence 88% · Jack Rhysider EP 91 Details
“there were a few clues that suggested that this attack came from China”
“they knew that it was China or some Chinese asset”
World Bank network intrusion COMPROMISES World Bank
The incident was a serious breach of the World Bank network.
Explicit Confidence 97% · Jack Rhysider EP 91 Details
“a serious breach in the network of a major bank”
World Bank DEVELOPED_BY Security Operations Center
After the incident, the World Bank built out a security operations center.
Explicit Direction flagged Confidence 97% · Jack Rhysider EP 91 Details
“They built out a SOC, they developed an incident-handling playbook”
World Bank network intrusion INVOLVES Mandiant
The World Bank called Mandiant to provide additional incident-response assistance.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“the bank realized they needed even more help, so they called Mandiant up”
World Bank network intrusion INVOLVES Forensic imaging
Investigators created forensic images of affected servers and later used remote forensic imaging on a suspect's computer.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had evidence that this attacker had accessed and changed configurations on thirty different servers”
“We could push out our remote forensic imaging element out to them and grab an image of their hard drive.”
World Bank network intrusion INVOLVES smart card authentication
The bank was transitioning from token-based authentication to smart-card authentication when the attackers gained access.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“they were in the process of switching everyone to use smart cards for authentication”
World Bank network intrusion INVOLVES file integrity monitoring
The intrusion was detected after file integrity monitoring indicated unauthorized changes on a server.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“the file integrity monitor triggered an alert and it showed that someone had made changes to a server”
World Bank network intrusion INVOLVES Password cracking
The investigation involved obtaining password hashes and cracking the enterprise administrator password.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“she decided to get the hashes herself and see if she could crack the password”
“was able to pull out the passwords for the enterprise admin rather quickly”
World Bank network intrusion INVOLVES hardware security module
One of the systems touched during the intrusion was the World Bank's hardware security module, described as holding cryptographic material.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“one of the machines that got touched was our HSM”
World Bank network intrusion INVOLVES multi-factor authentication
The bank had abandoned a multi-factor access program before the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had abandoned a multi-factor access program”
World Bank network intrusion INVOLVES Honeypot
Investigators planted fake information in a conference room as a honeypot to identify an internal leaker.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“We decided to set up a honeypot.”
“Started writing some fake stuff on the walls; put up some papers on the table”
World Bank network intrusion INVOLVES lateral movement
The attacker moved laterally from one server to other servers after gaining access.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Once they were in one computer, they were able to traverse the network to get into other computers.”
OPM breach INVOLVES Office of Personnel Management
The OPM breach involved intrusions on the Office of Personnel Management network.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had found some intrusions on the OPM network”
World Bank network intrusion INVOLVES Active Directory
An enterprise administrator account for Active Directory was compromised during the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“one of our three enterprise admins for AD’s account was compromised”
Amélie Koran MEMBER_OF Mandiant
Amélie Koran worked for Mandiant as its first full-time IT manager.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“As their first full-time IT manager.”
Amélie Koran MEMBER_OF World Bank
Amélie Koran worked as an information security engineer and contractor at the World Bank.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“I was just an information security engineer. I was just basic utility player. I was a contractor”
Darknet Diaries REFERENCES Fox News article: World Bank Under Cyber Siege in Unprecedented Crisis
The episode reads and discusses the Fox News article titled “World Bank Under Cyber Siege in Unprecedented Crisis.”
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Here, I’ll read the article for you. The headline says World Bank Under Cyber Siege in Unprecedented Crisis.”
webjedi SAME_AS Amélie Koran
Amélie Koran says that webjedi is her online handle.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“My handle is webjedi although back when I was in the BBS world, it was Thunderball”
Amélie Koran USES OmniGraffle
Amélie Koran used OmniGraffle to map the incident's systems, paths, and timeline.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“I’m doing all this stuff in Visio and OmniGraffle, mapping out all the paths”
Amélie Koran USES EnCase
Amélie Koran used EnCase and other tools to analyze a suspect's hard drive and reconstruct web caches.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“When we eventually pulled it through using stuff like EnCase and some other tools, reconstruct the web caches”
Mandiant's early Mirror tool was used in examining material that matched its work mapping Chinese threat actors.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“Mandiant, as part as some of the malware stuff that we had looked at using their Mirror tool”
Amélie Koran USES John the Ripper
Amélie Koran used John the Ripper to crack the enterprise administrator's password.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Amélie started John the Ripper, a tool used to crack passwords”
Amélie Koran USES Visio
Amélie Koran used Visio to map the incident's paths and affected systems.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“I’m doing all this stuff in Visio and OmniGraffle, mapping out all the paths”
World Bank USES smart card authentication
After the incident, the World Bank completed the rollout of smart-card authentication for everyone.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“they finished rolling out that smart card authentication for everyone”