Mohammed Aldoub MEMBER_OF Kuwaiti government
Mohammed says he got a job in the Kuwaiti government securing systems.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“I got a job in the government of Kuwait securing systems”
Episode
28 June 2022 Official episode · Official transcript
research cybercrime
The episode features Kuwaiti cybersecurity researcher Mohammed Aldoub, known online as Voulnet, and his legal ordeal after publicly analysing suspected banking malware and discussing possible links to a Gulf Bank incident.
Topics: Malware analysis and threat hunting, Banking malware targeting Gulf-region institutions, SWIFT-related bank attacks, Phishing of banking employees, Indicators of compromise, file hashes, and malware strings, VirusTotal malware intelligence, Cybersecurity research and public disclosure, Cybercrime law and freedom of speech, Attribution of state-linked bank robberies
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Mohammed Aldoub MEMBER_OF Kuwaiti government
Mohammed says he got a job in the Kuwaiti government securing systems.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“I got a job in the government of Kuwait securing systems”
Mohammed Aldoub ASSOCIATED_WITH Dan Kaminsky
Mohammed says he was introduced to Dan Kaminsky, whose guidance helped him enter cybersecurity.
Explicit Confidence 98% · Mohammed Aldoub EP 120 Details
“I actually got introduced to the late Dan Kaminsky, and his guidance was really amazing”
Mohammed Aldoub USES Threat hunting
Mohammed describes conducting threat-hunting work to find malware targeting Kuwait and the Gulf region.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“it was usually something regular that we tried to hunt for threats”
“I’m doing that usual threat hunting work”
Mohammed Aldoub USES VirusTotal
Mohammed says he used VirusTotal to look for malware samples and attacks targeting Kuwait and the region.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“One of the best avenues to look for such things is through using VirusTotal”
“I would use it to actually look for attacks that are targeting Kuwait”
Mohammed Aldoub USES malware analysis
Mohammed analyzed fresh malware samples and streamed or discussed his analysis publicly.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“trying to analyze the malware, how it works, what it does to the systems”
“downloaded and analyze it, and actually discussed on Twitter”
Mohammed Aldoub USES Indicators of compromise
Mohammed submitted malware hashes and shared indicators so people in the region could search their environments for the attack.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“submitted the hashes for that piece of malware so that anybody in the region could search for those hashes in their environment”
“these are some highly-probable indicators of compromise”
Mohammed Aldoub USES Strings extraction
Mohammed used strings extraction to identify human-readable strings in the malware, including GBKADMIN.
Explicit Confidence 99% · Mohammed Aldoub EP 120 Details
“I found some strings in those pieces of malware”
“one technique for analyzing malware is to run the command ‘strings’ on it”
Gulf Bank service disruption INVOLVES Gulf Bank of Kuwait
The incident was reported by Gulf Bank of Kuwait as a service disruption that resulted in a loss of millions of dollars.
Explicit Confidence 99% · Jack Rhysider EP 120 Details
“the Gulf Bank of Kuwait’s Twitter account saying they had a service disruption”
“This service disruption resulted in them losing $9 million”
Gulf Bank service disruption ASSOCIATED_WITH banking malware
Mohammed believed there might be a possible connection between the banking malware he found and the Gulf Bank incident, but said there was not enough concrete proof to link them.
Uncertain Confidence 97% · Mohammed Aldoub EP 120 Details
“there’s a possible connection there”
“there wasn’t a lot of, let’s say, concrete proof for me to be able to do that”
Kuwait bank robbery report ATTRIBUTED_TO Government of North Korea
The United Nations investigation report says the government of North Korea was responsible for robbing a bank in Kuwait in March 2019.
Attributed Confidence 99% · Mohammed Aldoub EP 120 Details
“this report says the government of North Korea is responsible for robbing banks in ... Kuwait”
“a bank in Kuwait was robbed by the government of North Korea”
Kuwait bank robbery report TARGETS Kuwait
The UN report describes a bank robbery in Kuwait.
Attributed Confidence 98% · Jack Rhysider EP 120 Details
“a bank in Kuwait was robbed”
Kuwait bank robbery report INVOLVES Swift
The broader bank-robbery campaign described in the episode involved compromising banks and targeting the SWIFT network to steal money; the episode discusses whether the Kuwait case was part of this campaign.
Derived Confidence 78% · Jack Rhysider EP 120 Details
“hacking into the bank, and then targeting the SWIFT network to steal millions of dollars from banks”
Kuwait bank robbery report INVOLVES phishing
The broader bank-robbery campaign described in the episode commonly began with phishing emails sent to banking employees; the episode connects this campaign context to the Kuwait robbery report without establishing that phishing was used in the Kuwait case specifically.
Derived Confidence 72% · Jack Rhysider EP 120 Details
“usually sending phishing e-mails to banking employees”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:39:52.523725+00:00