Project Raven PART_OF CyberPoint
Project Raven was described as a hacking unit operating within or for CyberPoint.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“Project Raven was a hacking unit working for a company called Cyber Point”
Organisation
organisation:project_raven
Also: Raven
Secret offensive cyber-operations unit operating from a villa in Abu Dhabi for the UAE government.
Secret offensive cyber-operations unit operating from a villa in Abu Dhabi for the UAE government.
“The name of the hacking unit Dave was assigned to was called Project Raven.”
“Project Raven was a hacking unit working for a company called Cyber Point”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | PART_OF | CyberPoint | Explicit | 47 |
| outgoing | ASSOCIATED_WITH | NISSA | Explicit | 47 |
| outgoing | ATTRIBUTED_TO | United Arab Emirates | Explicit | 47 |
| outgoing | USES | phishing | Explicit | 47 |
| outgoing | USES | Metasploit | Explicit | 47 |
| outgoing | USES | default credentials | Explicit | 47 |
| outgoing | USES | web shell | Explicit | 47 |
| outgoing | USES | lateral movement | Explicit | 47 |
| outgoing | USES | pass the hash | Explicit | 47 |
| outgoing | USES | living off the land | Explicit | 47 |
| outgoing | USES | Data exfiltration | Explicit | 47 |
| outgoing | USES | Karma | Explicit | 47 |
| incoming | MEMBER_OF | David | Explicit | 47 |
| incoming | MEMBER_OF | Lori Stroud | Explicit | 47 |
Project Raven PART_OF CyberPoint
Project Raven was described as a hacking unit operating within or for CyberPoint.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“Project Raven was a hacking unit working for a company called Cyber Point”
David MEMBER_OF Project Raven
David was assigned to the Project Raven hacking unit after moving to Abu Dhabi.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“The name of the hacking unit Dave was assigned to was called Project Raven.”
Project Raven ASSOCIATED_WITH NISSA
Project Raven was tasked with helping NISSA conduct offensive cyber operations and collect information from targets.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“you’re gonna be helping NISSA conduct offensive cyber operations”
Project Raven ATTRIBUTED_TO United Arab Emirates
The episode attributes Project Raven's hacking operations and contracting to the UAE government.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 47 Details
“It was the UAE government who was hiring them to conduct these hacks.”
Project Raven USES phishing
Project Raven personnel taught Emiratis how to establish phishing emails as an access method.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“how to set up a phishing e-mail and use Metasploit to gain access”
Project Raven USES Metasploit
Project Raven used or taught the use of Metasploit to gain access to victims' machines.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“use Metasploit to gain access to the victim’s machine”
Project Raven USES default credentials
Project Raven gained initial access to a government VPN using default credentials.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“That VPN was using default credentials.”
Project Raven USES web shell
The team uploaded an ASPX web shell through the Managed Engine ticket system to obtain access to a server.
Explicit Confidence 99% · David EP 47 Details
“you put an ASPX web shell on there, upload it as part of that ticket”
Project Raven USES lateral movement
David described moving laterally through compromised networks to reach additional systems and credentials.
Explicit Confidence 98% · David EP 47 Details
“login remotely until you get where you want to go to the domain controller”
Project Raven USES pass the hash
The team used pass-the-hash or plaintext credentials for remote access during lateral movement.
Explicit Confidence 99% · David EP 47 Details
“passing the hash or even the plain text password”
Project Raven USES living off the land
The team used living-off-the-land methods, including native network utilities, during lateral movement.
Explicit Confidence 98% · David EP 47 Details
“living off the land, your net bios, your SMB”
Project Raven USES Data exfiltration
Project Raven collected communications and other data from targets rather than conducting destructive operations.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“This was just collecting communications.”
Lori Stroud MEMBER_OF Project Raven
Lori worked on the analysis team at Project Raven.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“One of the people in that analysis team was named Lori Stroud.”
Project Raven USES Karma
Project Raven had access to and used, or could use, the Karma iPhone-hacking tool; the episode does not establish that David personally used it.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“Project Raven had access to this crazy hacking tool called Karma.”