Claim

Cloud Hopper USES Mimikatz

The attackers ran Mimikatz on the jump server and obtained nearly one hundred clear-text credentials, including Active Directory administrators.

Episode
EP 103 — Cloud Hopper
Origin
Explicit
Confidence
99% (extractor score, not a fact score)
Speaker
Fabio Viggiani
Attributed source
—

Transcript evidence

“including several Active Directory domain administrators”

Fabio Viggiani · offsets 16698–16754

“It was called thehostingoftheserver.mimikatz.hash.”

Fabio Viggiani · offsets 15204–15254

Read the official transcript

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:19:40.896704+00:00

claim:ep103:f51a890ec975