Marq experimented with Linux and later checked out BackTrack and its hacking tools.
Explicit Confidence 96% · Jack Rhysider EP 108 Details
“From there, he heard about BackTrack and was drawn to different hacking tools.”
Person
person:marq
Interview subject who describes accessing former clients’ systems, downloading customer data, and selling it on a dark-web forum.
Interview subject who describes accessing former clients’ systems, downloading customer data, and selling it on a dark-web forum.
“You can just call me Marq, of course.”
“I had access to everything, access to servers, yeah, access to literally everything.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | BackTrack | Explicit | 108 |
| outgoing | USES | Tor | Explicit | 108 |
| outgoing | MEMBER_OF | Oracle | Explicit | 108 |
| outgoing | USES | Micros | Explicit | 108 |
| outgoing | MEMBER_OF | Microsoft | Explicit | 108 |
| outgoing | USES | Exchange | Explicit | 108 |
| outgoing | USES | Office 365 | Explicit | 108 |
| outgoing | USES | PowerShell | Explicit | 108 |
| outgoing | USES | Unauthorized access using retained credentials | Explicit | 108 |
| outgoing | USES | Credential dump | Explicit | 108 |
| outgoing | USES | Event logs | Explicit | 108 |
| outgoing | USES | Bitcoin | Explicit | 108 |
| outgoing | USES | Remote Desktop Protocol | Explicit | 108 |
| outgoing | ASSOCIATED_WITH | Ring | Explicit | 108 |
| outgoing | ASSOCIATED_WITH | Insider threat | Attributed | 108 |
Marq experimented with Linux and later checked out BackTrack and its hacking tools.
Explicit Confidence 96% · Jack Rhysider EP 108 Details
“From there, he heard about BackTrack and was drawn to different hacking tools.”
Marq used Tor while in high school, but said he mainly explored it and did not conduct activities there at that time.
Explicit Confidence 98% · Marq EP 108 Details
“I went on Tor a couple of times, but honestly I never did anything.”
Oracle hired Marq after a recruiter found his resume, and he worked there for about a year and a half.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“a recruiter from Oracle found it and reached out, and Oracle hired him.”
“He worked there about a year and a half”
While working at Oracle, Marq supported its point-of-sale software called Micros.
Explicit Confidence 99% · Marq EP 108 Details
“I worked on their point-of-sale software called Micros. I was a support engineer.”
Marq was hired by Microsoft and worked there as an Exchange engineer.
Explicit Confidence 99% · Marq EP 108 Details
“I went through the interviewing process and I was hired. At Microsoft, I was a Exchange engineer”
In his Microsoft role, Marq helped administrators with Exchange issues, including on-premises, cloud, and hybrid setups.
Explicit Confidence 99% · Marq EP 108 Details
“At Microsoft, I was a Exchange engineer, so I helped mostly systems administrator, but I would help them with pretty much any Exchange issue.”
Marq USES Office 365
Marq supported Office 365 issues in his role as a Microsoft Exchange engineer.
Explicit Confidence 97% · Marq EP 108 Details
“it could be Office 365 issues, in the Cloud”
Marq USES PowerShell
A coworker asked Marq to write a PowerShell script for a client, although Marq described it as outside his area.
Explicit Confidence 98% · Marq EP 108 Details
“he wanted me to write a PowerShell script for this specific client that was just way out of my zone.”
Marq USES Unauthorized access using retained credentials
Two months after being fired, Marq used retained credentials to access his former employer's administration portal and customer servers.
Explicit Confidence 99% · Marq EP 108 Details
“I just checked to see if I still had access to one of the servers where we administered several of our clients. I still had access to everything.”
“He had remembered his username and password to get into that dashboard when he worked there, and he tried to log into the portal, and it worked.”
Marq USES Credential dump
Marq downloaded thousands of documents containing customer banking, tax, address, and identity-document information and sold a sample of the data.
Explicit Confidence 94% · Marq EP 108 Details
“that’s when I started to download quite a bit of the information from one of the servers.”
“It was thousands and thousands of documents. I want to say probably 15,000 documents in total.”
Marq USES Event logs
Because he had administrator access, Marq deleted event logs showing his login and download activity to conceal the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“he could just delete the event logs which showed his login and download activities.”
Marq sold access to the stolen data for $600 in Bitcoin and transferred the payment between his wallets.
Explicit Confidence 99% · Marq EP 108 Details
“The $600, of course, was in Bitcoin. Then yeah, they transferred the money to my wallet and I gave them the information they wanted.”
Marq USES Remote Desktop Protocol
Marq planned to create accounts with internet-accessible RDP credentials on additional servers so he could sell access to them.
Explicit Confidence 98% · Jack Rhysider EP 108 Details
“he would make a new user account and give it RDP access from the internet so he could sell that username and password”
Marq verified that credentials posted by other hackers gave access to a real Ring camera account, then reported the exposure.
Explicit Confidence 98% · Marq EP 108 Details
“I did sign onto one of the accounts just to see if I could see through her Ring camera and see if this was real, and it was”
Marq ASSOCIATED_WITH Insider threat
Lisa says Marq was technically an outsider when he acted, but discusses his case as an example of the circumstances and tipping points associated with insider threats.
Attributed Confidence 86% · Lisa Forte EP 108 Details
“in this particular case, I suppose technically at the time he did it, he was an outsider. But it’s no – there’s no bad apple that exists in an organization.”