Episode
26 October 2021 Official episode · Official transcript
cybercrime incident response
The episode describes an MSP-compromise campaign attributed in later US indictments to APT10, involving credential theft, DLL side-loading, PlugX, and attempts to reach US government networks through MSP customers.
Topics: Managed service provider compromise, Jump-server abuse, Command-and-control communications, Credential dumping with Mimikatz, Clear-text credentials in Windows memory, DLL side-loading, Encrypted payload loading and in-memory execution, Remote Desktop access, NetBIOS and NBTscan network scanning, Keylogging, Active Directory compromise and password reset, Lateral movement, Advanced persistent threats, Supply-chain compromise through IT service providers, Digital forensics and memory analysis, Endpoint detection and response
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Fabio Viggiani MEMBER_OF Truesec
Fabio Viggiani says he is an incident responder, threat analyst, and red teamer at Truesec.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“I’m an incident responder, threat analyst, and red teamer at Truesec.”
Cloud Hopper INVOLVES Swedish Security Service
The campaign investigation began after the Swedish Security Service notified the victim about communications with a command-and-control server.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“they had been contacted by the Swedish Security Service because one of the systems had been talking to a command and control server”
Managed Service Provider USES Virtual Private Network
The MSP used a VPN to access a jump server and then reach systems in the customer network.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“they set up a VPN to a server that they could use to jump off of when they needed to get in this network”
Managed Service Provider USES jump server
The MSP used jump servers to manage and access customer systems.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“it was one of the jump servers that the MSP used to manage this customer”
Cloud Hopper INVOLVES jump server
A customer MSP jump server was compromised and communicated with command-and-control infrastructure.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“this jump server that was reaching out to a known command and control server”
Cloud Hopper USES Mimikatz
The attackers ran Mimikatz on the jump server and obtained nearly one hundred clear-text credentials, including Active Directory administrators.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“including several Active Directory domain administrators”
“It was called thehostingoftheserver.mimikatz.hash.”
Mimikatz EXPLOITS Windows password handling flaw
Mimikatz extracts passwords from Windows memory where clear-text credentials may be cached.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“Windows has a major flaw in the way it handles passwords.”
“Mimikatz is a tool that goes to the exact spot in memory and grabs the password”
Mimikatz USES credential dumping
Mimikatz was used to dump usernames and passwords from the compromised system.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“Mimikatz found a lot of passwords”
Cloud Hopper INVOLVES DLL side-loading
The attackers used DLL side-loading implants to execute malware through legitimate software binaries.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“We found three more instances of DLL side-loading implants”
Cloud Hopper USES Vba32 AntiRootkit Scanner
A legitimate Vba32 AntiRootkit Scanner binary was used in the DLL side-loading mechanism and connected to command-and-control infrastructure.
Explicit Confidence 97% · Fabio Viggiani EP 103 Details
“The name of the process was vba32arkit.exe”
“turned out to be a legitimate software called Vba32 AntiRootkit Scanner”
Cloud Hopper USES NBTscan
The attackers used NBTscan to scan public IP ranges for NetBIOS file-sharing connections.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“It was a legitimate tool called NBTscan. It’s a NetBIOS main network scanner.”
NBTscan was used as a NetBIOS network scanner.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“NBTscan. It’s a NetBIOS main network scanner.”
Cloud Hopper INVOLVES network scanning
The attackers scanned public IP ranges, including ranges belonging to the US Department of Defense, for shared network drives.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“nineteen of those public IP ranges belonged to the US Department of Defense”
Cloud Hopper TARGETS United States Department of Defense
The campaign scanned DoD address ranges and was ultimately associated with efforts to reach US government networks.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“This threat actor was using this server and this company’s network to scan the US Department of Defense’s servers”
Cloud Hopper USES Remote Desktop
The malware was placed on the server after an attacker logged in through Remote Desktop using stolen credentials.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“someone simply logged into this computer normally, through Remote Desktop, and put it there”
Cloud Hopper INITIAL_ACCESS_VIA Remote Desktop
The investigated server was initially accessed through Remote Desktop with a stolen MSP employee account.
Explicit Confidence 96% · Jack Rhysider EP 103 Details
“They logged into it and put the malware on.”
Cloud Hopper INVOLVES PlugX
The attackers later installed PlugX on the compromised server.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“they brought in a known malware called PlugX”
PlugX VARIANT_OF Remote access Trojan
Fabio identifies PlugX as a known remote access trojan.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“PlugX is a known RAT”
Cloud Hopper INVOLVES credential dumping
After entering the network, the attackers ran Mimikatz to collect credentials.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“it was then when Mimikatz was run where they grabbed all the credentials”
Cloud Hopper INVOLVES lateral movement
The attackers used stolen credentials to pivot and traverse to other systems, including the domain controller.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“started pivoting and traversing to other systems in the network”
Cloud Hopper COMPROMISES Domain controller
The attackers gained full administrator access to the customer’s domain controller.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“they got into the domain controller of this network and had full admin access there”
Cloud Hopper INVOLVES keylogger
Keyloggers were found on MSP jump servers and could capture credentials for multiple customers.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“we know that they found key loggers on the jump servers at the MSP’s site”
Cloud Hopper COMPROMISES Managed Service Provider
The campaign compromised MSP infrastructure and used it to reach multiple customers.
Explicit Confidence 99% · Rod Rosenstein EP 103 Details
“the defendants are accused of targeting and compromising Managed Service Providers or MSPs”
Cloud Hopper TARGETS Managed Service Provider
The campaign targeted MSPs because they had trusted access to customer networks and data.
Explicit Confidence 99% · Rod Rosenstein EP 103 Details
“the defendants are accused of targeting and compromising Managed Service Providers or MSPs”
Cloud Hopper ATTRIBUTED_TO APT10
The US Department of Justice indictment alleges that the defendants worked for a group known to cybersecurity experts as APT10.
Attributed Confidence 99% · Rod Rosenstein EP 103 Details
“The indictment alleges that the defendants work for a group known to cyber-security experts as APT10.”
APT10 ASSOCIATED_WITH Ministry of State Security
The defendants associated with APT10 were alleged to have committed the crimes in association with China’s Ministry of State Security.
Attributed Confidence 98% · Rod Rosenstein EP 103 Details
“The defendants allegedly committed these crimes in association with a Chinese intelligence agency known as the Ministry of State Security.”
The indictment identifies the hackers as associated with the Chinese government, while the specific allegations are attributed to the US Department of Justice.
Attributed Confidence 98% · Rod Rosenstein EP 103 Details
“two hackers associated with the Chinese government”
The US attorney said APT10 hacking campaigns targeted NASA laboratories.
Attributed Confidence 99% · Jeffrey Burman EP 103 Details
“targeted US government agencies including the laboratories of NASA”
APT10 TARGETS United States Department of Energy
The US attorney said APT10 hacking campaigns targeted the US Department of Energy.
Attributed Confidence 99% · Jeffrey Burman EP 103 Details
“the laboratories of NASA, the United States Department of Energy, and the US Navy”
APT10 TARGETS United States Navy
The US attorney said APT10 hacking campaigns targeted the US Navy and stole personal information from over 100,000 Navy personnel.
Attributed Confidence 99% · Jeffrey Burman EP 103 Details
“The defendant’s hacking campaigns also targeted US government agencies”
“from over 100,000 Navy personnel”
Cloud Hopper INVOLVES Hewlett Packard Enterprise
Reuters journalists reportedly identified Hewlett Packard Enterprise as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“seven different service providers were compromised, and they listed Hewlett Packard Enterprise”
Cloud Hopper INVOLVES IBM
Reuters journalists reportedly identified IBM as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“they listed Hewlett Packard Enterprise, IBM, Fujitsu”
Cloud Hopper INVOLVES Fujitsu
Reuters journalists reportedly identified Fujitsu as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“IBM, Fujitsu, TADA Consultancy”
Cloud Hopper INVOLVES Ericsson
Reuters reportedly listed Ericsson among customers affected by the compromised service providers.
Attributed Confidence 94% · Jack Rhysider EP 103 Details
“the telecom giant Ericsson”
Cloud Hopper INVOLVES Sabre
Reuters reportedly listed Sabre among customers affected by the compromised service providers.
Attributed Confidence 94% · Jack Rhysider EP 103 Details
“the travel reservation service Sabre”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:19:40.896704+00:00