NBTscan was used as a NetBIOS network scanner.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“NBTscan. It’s a NetBIOS main network scanner.”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
NBTscan was used as a NetBIOS network scanner.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“NBTscan. It’s a NetBIOS main network scanner.”
Managed Service Provider USES jump server
The MSP used jump servers to manage and access customer systems.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“it was one of the jump servers that the MSP used to manage this customer”
Cloud Hopper USES Vba32 AntiRootkit Scanner
A legitimate Vba32 AntiRootkit Scanner binary was used in the DLL side-loading mechanism and connected to command-and-control infrastructure.
Explicit Confidence 97% · Fabio Viggiani EP 103 Details
“The name of the process was vba32arkit.exe”
“turned out to be a legitimate software called Vba32 AntiRootkit Scanner”
Mimikatz USES credential dumping
Mimikatz was used to dump usernames and passwords from the compromised system.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“Mimikatz found a lot of passwords”
Cloud Hopper USES Remote Desktop
The malware was placed on the server after an attacker logged in through Remote Desktop using stolen credentials.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“someone simply logged into this computer normally, through Remote Desktop, and put it there”
Cloud Hopper USES NBTscan
The attackers used NBTscan to scan public IP ranges for NetBIOS file-sharing connections.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“It was a legitimate tool called NBTscan. It’s a NetBIOS main network scanner.”
Managed Service Provider USES Virtual Private Network
The MSP used a VPN to access a jump server and then reach systems in the customer network.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“they set up a VPN to a server that they could use to jump off of when they needed to get in this network”
Cloud Hopper USES Mimikatz
The attackers ran Mimikatz on the jump server and obtained nearly one hundred clear-text credentials, including Active Directory administrators.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“including several Active Directory domain administrators”
“It was called thehostingoftheserver.mimikatz.hash.”
PlugX VARIANT_OF Remote access Trojan
Fabio identifies PlugX as a known remote access trojan.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“PlugX is a known RAT”
Arya Ebrahami ASSOCIATED_WITH AlphaBay
Arya became a junior moderator and staff member of AlphaBay, handling disputes and moderation.
Explicit Confidence 99% · Jack Rhysider EP 104 Details
“he was now part of the staff on AlphaBay, helping them run the site”
noveltyids.co ASSOCIATED_WITH Arya Ebrahami
Arya identifies noveltyids.co as the website he relaunched and promoted as Oracle from Silk Road.
Explicit Confidence 99% · Arya Ebrahami EP 104 Details
“I said hey everyone, it’s Oracle from Silk Road, veteran vendor from Silk Road. Here’s my Clearnet website”
Oracle ASSOCIATED_WITH Arya Ebrahami
Oracle was Arya’s vendor name on Silk Road; the episode presents the pseudonym as Arya’s marketplace identity.
Explicit Confidence 99% · Jack Rhysider EP 104 Details
“His vendor name there was Oracle”
Arya Ebrahami ASSOCIATED_WITH Nucleus
Arya became a staff member of Nucleus and performed support and forum-moderation work there.
Explicit Confidence 99% · Arya Ebrahami EP 104 Details
“I became staff on their website”
“I did support tickets, I handled their forum”
The episode identifies Alex as AlphaBay’s administrator and says he ran the site.
Attributed Confidence 96% · Jack Rhysider EP 104 Details
“the admin was a guy named Alex”
“the admin who ran the site”
Novelty ID Store ASSOCIATED_WITH Arya Ebrahami
Arya says Novelty ID Store was his fake-ID website and that it was publicly identified as being run by him.
Explicit Confidence 99% · Arya Ebrahami EP 104 Details
“noveltyidstore.com is a scam run by Arya Ebrahami”
AlphaBay takedown INVOLVES AlphaBay
The AlphaBay takedown involved federal authorities taking AlphaBay down; Arya learned of it while in prison.
Explicit Confidence 99% · Jack Rhysider EP 104 Details
“AlphaBay had been taken down by the feds”
Operation Breaking Bars INVOLVES Arya Ebrahami
Operation Breaking Bars was the county police operation connected to Arya’s Xanax distribution activity.
Explicit Confidence 99% · Jack Rhysider EP 104 Details
“The county police called his Operation Breaking Bars”
Silk Road seizure INVOLVES Silk Road
The Silk Road seizure involved the FBI seizing the Silk Road site.
Explicit Confidence 99% · Arya Ebrahami EP 104 Details
“The FBI arrested the owner of Silk Road and seized the site”
Silk Road OPERATED_BY Ross Ulbricht
Ross Ulbricht is described as the person arrested for running Silk Road.
Explicit Confidence 97% · Jack Rhysider EP 104 Details
“the guy who was arrested for running Silk Road, Ross Ulbricht”
Darknet Diaries REFERENCES Operation Bayonet
Jack recommends listening to Operation Bayonet before this episode because it provides background on darknet marketplaces and overlaps with this episode.
Explicit Confidence 99% · Jack Rhysider EP 104 Details
“I highly recommend that you listen to Episode 24 first. It’s called Operation Bayonet”
PharmaKing USES AlphaBay
PharmaKing was an AlphaBay vendor from whom Arya bought Xanax.
Explicit Confidence 99% · Arya Ebrahami EP 104 Details
“I found a vendor on AlphaBay that I ended up becoming his number-one customer. It was this vendor named PharmaKing”
Delaware Fakes USES Doxxing
Arya says Delaware Fakes doxxed him by publishing his picture, name, and address.
Attributed Confidence 94% · Arya Ebrahami EP 104 Details
“It was a guy named Delaware Fakes. He was a whole separate company”
“they were the first people to dox me”
Arya Ebrahami USES Evolution market
Arya bought counterfeit money on Evolution market.
Explicit Confidence 99% · Arya Ebrahami EP 104 Details
“I had bought fake money online on Evolution market”
Oracle was Arya’s vendor account used to sell fake IDs on Silk Road.
Explicit Confidence 99% · Jack Rhysider EP 104 Details
“He decided to make a vendor account on Silk Road to sell fake IDs”
Arya Ebrahami USES Bitcoin
Arya accepted payment in Bitcoin for fake IDs and held Bitcoin in his wallet.
Explicit Confidence 99% · Arya Ebrahami EP 104 Details
“I’m getting paid in Bitcoin, dude”