Episode
15 January 2018 Official episode · Official transcript
incident response
An incident-response consultant describes investigating a long-running, state-sponsored intrusion into an unnamed technology company, including intellectual-property theft, lateral movement, and delayed remediation.
Topics: Advanced Persistent Threats (APT), Incident response and digital forensics, Compromise assessment, Indicators of compromise (IOCs), Malware profiling, Lateral movement, Intellectual-property theft and exfiltration, Threat monitoring and discovery phases, Back doors and ingress points, Delayed remediation to preserve visibility into attacker activity
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Andrew USES incident response
Andrew works on a team that performs incident response and participates in incident-response engagements.
Explicit Confidence 97% · Jack Rhysider EP 11 Details
“Andrew works on a team that does incident response.”
“We spun it up to – the company that I work for spun it up to a follow incident response engagement.”
Andrew USES digital forensics
Andrew participates in digital-forensics work during the engagement.
Explicit Confidence 99% · Andrew EP 11 Details
“I came in as part of the team that was doing some of the forensics work”
Andrew USES remediation
Andrew is scheduled to perform remediation to remove the threat from the client environment.
Explicit Confidence 91% · Andrew EP 11 Details
“I was sitting in the airport waiting to fly out”
“He’s scheduled to do the remediation in just two days.”
Advanced Persistent Threat ASSOCIATED_WITH state-sponsored group
Andrew says he was told that the APT group was state-sponsored, while expressing uncertainty about the attribution and location.
Uncertain Confidence 88% · Andrew EP 11 Details
“So I’ve been told, it’s state-sponsored. It’s in the east, I guess.”
malware ATTRIBUTED_TO state-sponsored group
The malware found in the network matched malware described in a published report that linked it to the APT group.
Attributed Confidence 93% · Jack Rhysider EP 11 Details
“the malware found in the network matched exactly the same malware that someone had published in a report which linked it back to that APT group”
threat actor USES lateral movement
The threat actor was observed moving laterally within the client environment during the monitoring and discovery phases.
Explicit Confidence 99% · Andrew EP 11 Details
“We could see lateral movement”
threat actor USES exfiltration
The threat actor targeted R&D systems and exfiltrated intellectual property.
Explicit Confidence 99% · Andrew EP 11 Details
“They were looking to exfiltrate and they did exfiltrate some intellectual property.”
threat actor USES back door
The investigators sought to identify the back doors the threat actor had into the environment.
Explicit Confidence 94% · Andrew EP 11 Details
“try and identify how many back doors these people have into their environment”
The malware was observed running on and being updated across endpoints in the client environment.
Derived Confidence 89% · Andrew EP 11 Details
“making sure that their malware is still running and deploying newer versions”
“on these end-points”
Darknet Diaries REFERENCES darknetdiaries.com
The podcast directs listeners to darknetdiaries.com for show notes and links.
Explicit Confidence 99% · Jack Rhysider EP 11 Details
“For show notes and links, check out darknetdiaries.com.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T03:36:51.543110+00:00