Claim

Defcon financial-data exfiltration INVOLVES FTP

The financial-data exfiltration incident involved recurring FTP traffic to a host in a .ru domain.

Episode
EP 157 — Grifter
Origin
Explicit
Confidence
99% (extractor score, not a fact score)
Speaker
Grifter
Attributed source
—

Transcript evidence

“We look and it’s FTP traffic going to a host name, not even an IP address but a host name that ends in .ru”

Grifter · offsets 68864–68970

Read the official transcript

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:37:53.087263+00:00

claim:ep157:3feb36ad907f