Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
police department ransomware incident COMPROMISES Domain controller
Unauthorized administrators logged into the domain controller and an attacker uploaded malware to stage another ransomware infection.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“this user did upload some malware and looks like they were staging it to infect the network with ransomware again”
police department ransomware incident INITIAL_ACCESS_VIA Remote Desktop exposure
The episode attributes the ransomware access to the domain controller being exposed to the internet through Remote Desktop.
Explicit Confidence 97% · Jack Rhysider EP 96 Details
“the police department was hit with ransomware because this system was accessible from the internet”
police department ransomware incident INVOLVES Domain controller
The attack involved the police department's domain controller, which was accessible and later used to stage malware.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“this police station’s domain controller was accessible from the internet over Remote Desktop”
police department ransomware incident INVOLVES phishing email
A later investigation found that a phishing email led to credentials being stolen from the mayor's computer.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“they were able to find a phishing e-mail. There was credentials stolen.”
police department ransomware incident INVOLVES Remote Desktop
The attacker and legitimate users accessed the domain controller through Remote Desktop.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“admin credentials to this server, to RDP in”
police department ransomware incident INVOLVES shared administrator credentials
The incident involved shared administrator credentials used by the mayor, city council members, and others.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“we all have the admin credentials; they’re all the same”
police department ransomware incident INVOLVES Ransomware
The police department was hit by ransomware across its network.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“It was ransomware across the entire network.”
police department ransomware incident INVOLVES backup failure
The incident involved untested and outdated backups; the latest usable backup was ten months old.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“they did not test their backups prior to deploying them”
“The latest backup they had was from ten months ago.”
police department ransomware incident INVOLVES keylogging
The attacker used a keystroke logger on the mayor's computer to observe credentials typed during a Remote Desktop login.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“The attacker put a keystroke logger on the computer and watched what the mayor did.”
police department ransomware incident INVOLVES the mayor of the city
The mayor's home computer and credentials were part of the attack path; the episode does not conclude that the mayor himself conducted the attack.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“There was somebody in the mayor’s computer that ended up gaining access to the server through the mayor’s home computer.”
Nicole Beckwith MEMBER_OF U.S. Secret Service
Nicole Beckwith says she was sworn in as a task force officer for the Secret Service's Financial and Electronic Crimes Division.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“they swore me in as a task force officer for their Financial and Electronic Crimes Division”
the mayor of the city USES Remote Desktop
The mayor says he used Remote Desktop to access the police department server remotely to check email.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“logging into the police department’s domain server to check your e-mail”
“logging into this server through Remote Desktop”
Nicole Beckwith USES Wireshark
Nicole used Wireshark to capture network traffic during the live investigation.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“I started Wireshark up and I’m dumping network traffic to a USB also.”
Nicole Beckwith USES network traffic capture
Nicole captured network traffic for later analysis during the incident response.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“I wanted to grab network traffic and so, I started Wireshark up and I’m dumping network traffic”
Nicole Beckwith USES memory imaging
Nicole performed memory dumping or imaging as part of the forensic response.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“I immediately start dumping the memory”
Nicole Beckwith USES Volatility
Nicole used Volatility to dump memory and collect forensic data from the server.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“I immediately start dumping the memory, so Volatility is one of my hands-down favorite tools to use.”
The Pizza Problem COMPROMISES Twitter
During the first attack, the attacker accessed Miles’s Twitter account.
Explicit Confidence 99% · Miles EP 97 Details
“They got into Twitter”
The Pizza Problem COMPROMISES Instagram
During the first attack, the attacker accessed Miles’s Instagram account.
Explicit Confidence 99% · Miles EP 97 Details
“they got into Instagram”
The Pizza Problem COMPROMISES Gmail
During the first attack, the attacker accessed and reset Miles’s Gmail account.
Explicit Confidence 99% · Miles EP 97 Details
“They got into Twitter, they got into Instagram, they got into Gmail”
The Pizza Problem INITIAL_ACCESS_VIA social engineering
The attackers appear to have gained access by socially engineering mobile-provider representatives; Miles said they manipulated T-Mobile into changing the SIM.
Uncertain Confidence 91% · Miles EP 97 Details
“manipulate their way in through either doing it in person or doing it over the phone”
The Pizza Problem INVOLVES Password recovery
After the SIM swap, the attacker used password recovery to reset Miles’s Gmail password and reach other accounts.
Explicit Confidence 99% · Jack Rhysider EP 97 Details
“proceeded to do a password recovery on his Gmail account”
The Pizza Problem INVOLVES Swatting
Miles feared that the harassment could escalate to swatting.
Uncertain Confidence 91% · Miles EP 97 Details
“this sort of thing can lead to swatting and fire-trucking”
The Pizza Problem INVOLVES SIM swapping
The incident involved repeated attempts to take over Miles’s phone number through SIM swapping.
Explicit Confidence 99% · Jack Rhysider EP 97 Details
“someone SIM-swapped Miles’ phone number over to theirs”
The Pizza Problem INVOLVES OGUsers
OGUsers was described as a marketplace where desirable account handles were offered for sale, providing a possible profit motive for the harassment.
Uncertain Confidence 95% · Jack Rhysider EP 97 Details
“one of these marketplaces is called ogusers.com”
“whoever was harassing him was probably doing it to make money off his account”
The Pizza Problem INVOLVES T-Mobile
T-Mobile was involved in the later SIM-hack attempt and worked with Miles to lock down his account.
Explicit Confidence 99% · Miles EP 97 Details
“I was on the phone with T-Mobile immediately”
“worked with T-Mobile to lock it down”