Omar Avilez MEMBER_OF Dominican Republic National CSIRT
Omar says he used to work in the Dominican Republic National CSIRT.
Explicit Confidence 99% · Omar Avilez EP 135 Details
“I used to work in the Dominican Republic National CSIRT”
Episode
04 July 2023 Official episode · Official transcript
advanced persistent threat cybercrime incident response
The episode describes a coordinated 2022 cyber campaign affecting Dominican Republic government agencies, critical infrastructure, and a bank, involving Bandook, Dark Caracal, Cobalt Strike, and Conti-related activity, with attribution to Russia and other actors presented as uncertain.
Topics: Ransomware campaigns, Phishing and spearphishing, Privilege escalation, Zero-day vulnerabilities, Fortinet firewall exploitation, VPN access, Command and control infrastructure, Cobalt Strike, Bandook backdoor, DNS monitoring, Threat intelligence, Indicators of compromise, Incident response, Operational technology, Attribution uncertainty, Network detection and response, Pyramid of pain
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Omar Avilez MEMBER_OF Dominican Republic National CSIRT
Omar says he used to work in the Dominican Republic National CSIRT.
Explicit Confidence 99% · Omar Avilez EP 135 Details
“I used to work in the Dominican Republic National CSIRT”
Dominican Republic National CSIRT ASSOCIATED_WITH FIRST
The Dominican Republic CSIRT participates in the FIRST incident-response community and uses it to connect with other teams for assistance.
Explicit Confidence 91% · Omar Avilez EP 135 Details
“FIRST is a forum for incident response”
Costa Rica ransomware attack INVOLVES Conti
Twenty Costa Rican government organizations were hit with Conti ransomware.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“twenty different government organizations in Costa Rica were hit with this Conti ransomware”
Costa Rica ransomware attack INITIAL_ACCESS_VIA phishing
The Costa Rica campaign infected departments through phishing emails as well as other internet-connected systems.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“They were attacking government organizations through phishing”
The D.R. Incident INVOLVES Quantum ransomware
The Dominican Republic agricultural department suffered a ransomware attack attributed in the report to the Quantum ransomware group.
Explicit Confidence 98% · Host2 EP 135 Details
“The Dominican Republic’s agricultural department has suffered a ransomware attack by the Quantum ransomware group”
The D.R. Incident INITIAL_ACCESS_VIA phishing
The investigation found that the attackers entered the network through a phishing attack.
Explicit Confidence 99% · Omar Avilez EP 135 Details
“the attackers got into the network via a phishing attack”
The D.R. Incident INVOLVES Fortinet firewall vulnerability
The Quantum attackers exploited a Fortinet firewall vulnerability to obtain VPN access to the infrastructure.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“They exploited a vulnerability, a Fortinet firewall that allowed them to have VPN access to the infrastructure”
Fortinet firewall vulnerability AFFECTS Fortinet firewall
The vulnerability affected a Fortinet firewall and enabled VPN access.
Explicit Confidence 96% · Omar Avilez EP 135 Details
“a vulnerability, a Fortinet firewall that allowed them to have VPN access”
The D.R. Incident INVOLVES Bandook
Hundreds of phishing emails contained or used Bandook as the attackers' backdoor.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“all of them had a backdoor the attackers were using, which was a backdoor known as Bandook”
The D.R. Incident INVOLVES Cobalt Strike
A compromised system downloaded Cobalt Strike, and a later Cobalt Strike implant communicated with Conti's command-and-control infrastructure.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“a system did get infected and it reached out to the command and control server to download Cobalt Strike”
“they now downloaded or installed a second malware, which was a Cobalt Strike implant which was communicating to Conti’s C2”
The D.R. Incident INVOLVES Conti
The Dominican Republic campaign included Conti-related command-and-control activity and staged Conti ransomware, although the ransomware was stopped before execution.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“a Cobalt Strike implant which was communicating to Conti’s C2”
“they seemed to have stopped the Conti ransomware attack before it actually triggered ransomware on any systems”
Conti USES command and control server
A command-and-control server was utilized by Conti to control infected systems.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“a C2 server that was utilized by Conti”
Cobalt Strike USES command and control server
The Cobalt Strike implant communicated with Conti's command-and-control server.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“a Cobalt Strike implant which was communicating to Conti’s C2”
Bandook ASSOCIATED_WITH Dark Caracal
Jack says Bandook has been known to be used by Dark Caracal, but presents the connection as suggestive rather than certain.
Uncertain Confidence 91% · Jack Rhysider EP 135 Details
“the Bandook malware has been known to be used by a group called Dark Caracal”
Dark Caracal ASSOCIATED_WITH Lebanon
Jack says there are clues suggesting that the Lebanese government is somehow behind Dark Caracal, while noting that the group's identity is not certain.
Uncertain Confidence 88% · Jack Rhysider EP 135 Details
“there are quite a bit of clues that lead us to believe that the Lebanese government is somehow behind this Dark Caracal group”
Jack says Conti has been widely attributed to Russia.
Attributed Confidence 91% · Jack Rhysider EP 135 Details
“Conti has been widely-attributed to be from Russia”
The D.R. Incident ATTRIBUTED_TO Russia
Omar says his partners told him Russia was involved in the Dominican Republic campaign, but he also presents the attribution as uncertain and based on what they learned during the investigation.
Uncertain Confidence 72% · Omar Avilez EP 135 Details
“they told us that it was not just Dark Caracal; it was not just Conti, but also it was — Russia was also involved”
The D.R. Incident ATTRIBUTED_TO Dark Caracal
The campaign was associated with Dark Caracal in the investigation, but the episode emphasizes that attribution was not clear.
Uncertain Confidence 72% · Omar Avilez EP 135 Details
“it was not just Dark Caracal; it was not just Conti”
“This attribution wasn’t exactly clear”
Dominican Republic National CSIRT USES DNS
The Dominican Republic CSIRT implemented a tool to analyze DNS queries across government organizations for visibility into network activity.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“we got a tool to analyze all the DNS queries that the organization made”
Dominican Republic National CSIRT USES Threat intelligence
The CSIRT used threat intelligence by comparing observed domains against known malicious domains.
Explicit Confidence 95% · Jack Rhysider EP 135 Details
“This is called threat intelligence”
The D.R. Incident INVOLVES operational technology
The campaign reached critical infrastructure, but the attackers could not disrupt the operational technology controlling it.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“They tried to but they could not. The critical infrastructure works — what we call the OT, which is operational technology”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:56:50.306609+00:00