Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Marq USES Credential dump
Marq downloaded thousands of documents containing customer banking, tax, address, and identity-document information and sold a sample of the data.
Explicit Confidence 94% · Marq EP 108 Details
“that’s when I started to download quite a bit of the information from one of the servers.”
“It was thousands and thousands of documents. I want to say probably 15,000 documents in total.”
While working at Oracle, Marq supported its point-of-sale software called Micros.
Explicit Confidence 99% · Marq EP 108 Details
“I worked on their point-of-sale software called Micros. I was a support engineer.”
Marq used Tor while in high school, but said he mainly explored it and did not conduct activities there at that time.
Explicit Confidence 98% · Marq EP 108 Details
“I went on Tor a couple of times, but honestly I never did anything.”
Marq USES PowerShell
A coworker asked Marq to write a PowerShell script for a client, although Marq described it as outside his area.
Explicit Confidence 98% · Marq EP 108 Details
“he wanted me to write a PowerShell script for this specific client that was just way out of my zone.”
Marq USES Office 365
Marq supported Office 365 issues in his role as a Microsoft Exchange engineer.
Explicit Confidence 97% · Marq EP 108 Details
“it could be Office 365 issues, in the Cloud”
Marq USES Remote Desktop Protocol
Marq planned to create accounts with internet-accessible RDP credentials on additional servers so he could sell access to them.
Explicit Confidence 98% · Jack Rhysider EP 108 Details
“he would make a new user account and give it RDP access from the internet so he could sell that username and password”
Binary Defense USES Confidential informant
Binary Defense bought the data on the forum, investigated the seller and victim, and turned the findings over to the FBI; Jack characterizes this role as a confidential informant.
Explicit Confidence 95% · Jack Rhysider EP 108 Details
“they investigate the data to try to figure out who the victim was and who the person is that sold this to them, and then they just turned all that over to the FBI.”
“It’s what’s known as a confidential informant.”
In his Microsoft role, Marq helped administrators with Exchange issues, including on-premises, cloud, and hybrid setups.
Explicit Confidence 99% · Marq EP 108 Details
“At Microsoft, I was a Exchange engineer, so I helped mostly systems administrator, but I would help them with pretty much any Exchange issue.”
Marq experimented with Linux and later checked out BackTrack and its hacking tools.
Explicit Confidence 96% · Jack Rhysider EP 108 Details
“From there, he heard about BackTrack and was drawn to different hacking tools.”
Marq sold access to the stolen data for $600 in Bitcoin and transferred the payment between his wallets.
Explicit Confidence 99% · Marq EP 108 Details
“The $600, of course, was in Bitcoin. Then yeah, they transferred the money to my wallet and I gave them the information they wanted.”
malicious APK AFFECTS Android
The alleged malicious APK was downloaded onto Junaid's Android phone.
Uncertain Confidence 86% · MLT EP 109 Details
“onto his Android phone”
MyBB zero-day exploit AFFECTS MyBB
The zero-day exploit affected MyBB and allowed a shell to be spawned on it.
Explicit Confidence 98% · MLT EP 109 Details
“a zero-day exploit at the time that allowed us to spawn a shell on MyBB”
Cyber Caliphate ASSOCIATED_WITH ISIS
The Cyber Caliphate was created to carry out cyber attacks on behalf of ISIS.
Explicit Confidence 98% · Jack Rhysider EP 109 Details
“to carry out cyber attacks on behalf of ISIS”
MLT felt loosely affiliated with Anonymous and observed activity in its IRC chat rooms; this was not presented as formal membership.
Uncertain Confidence 93% · Jack Rhysider EP 109 Details
“For a while, MLT felt loosely affiliated with Anonymous”
TeaMp0isoN ASSOCIATED_WITH Anonymous
TeaMp0isoN sprang out of Anonymous and was once loosely affiliated with it, but later separated itself from Anonymous.
Uncertain Confidence 94% · Jack Rhysider EP 109 Details
“TeaMp0isoN sort of sprang out of Anonymous and was once loosely affiliated with them”
MyBB zero-day exploit DEVELOPED_BY MLT
MLT said that he identified the vulnerability underlying the MyBB zero-day exploit.
Explicit Confidence 96% · MLT EP 109 Details
“It was me that identified the vulnerability”
MLT recently started the legally oriented hacking group 0xffff.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“MLT has taken his interest in all this and recently started a new hacking group called 0xffff”
Cyber Caliphate DEVELOPED_BY TriCk
Junaid Hussain started the Cyber Caliphate to conduct cyber attacks on behalf of ISIS.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 109 Details
“He started a new hacker group called the Cyber Caliphate”
MyBB zero-day exploit DEVELOPED_BY TriCk
TriCk was the person who exploited the vulnerability to spawn the shell; the episode describes the exploit as jointly developed and used by the pair.
Derived Confidence 78% · MLT EP 109 Details
“it was TriCk that actually exploited the vulnerability to spawn the shell”
poison.org DEVELOPED_BY TriCk
TriCk was described as the founder, administrator, and moderator of poison.org.
Explicit Confidence 99% · MLT EP 109 Details
“poison.org which TriCk was the administrator of”
MyBB zero-day exploit EXPLOITS zero-day vulnerability
The exploit was a zero-day exploit developed to take advantage of a MyBB vulnerability.
Explicit Confidence 97% · MLT EP 109 Details
“We actually developed a zero-day exploit at the time”
TriCk EXPLOITS zero-day vulnerability
TriCk exploited the zero-day vulnerability to spawn a shell on MyBB.
Explicit Confidence 99% · MLT EP 109 Details
“it was TriCk that actually exploited the vulnerability to spawn the shell”
P. Diddy hotel compromise INITIAL_ACCESS_VIA phishing
The hotel compromise began with a phishing email crafted to appear to come from another hotel employee.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“it started with a phishing e-mail”
P. Diddy hotel compromise INVOLVES lateral movement
After gaining access, the attackers performed lateral movement to other machines on the hotel network.
Explicit Confidence 99% · MLT EP 109 Details
“we performed some lateral movement and gained access to some other machines on the network”
P. Diddy hotel compromise INVOLVES Malware
The attached application in the phishing email was malware that gave TeaMp0isoN access to a hotel computer.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“the app was malware, so when the employee opened it, it gave TeaMp0isoN access to the computer in the hotel”