Claim

ThreatLocker hospital ransomware incident INITIAL_ACCESS_VIA VPN

The threat actor obtained domain-administrator credentials from the dark web and used them to remotely access the environment through the VPN.

Episode

EP 167 — Threatlocker

Origin

Explicit

Confidence

99% (extractor score, not a fact score)

Speaker

Hunter Clark

Attributed source

—

Transcript evidence

Read the official transcript

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:49:49.172886+00:00

claim:ep167:1056c7ecb9fb