Kanti VARIANT_OF Ransomware
Jack describes Kanti as a type of ransomware.
Explicit Confidence 99% · Jack Rhysider EP 167 Details
“Kanti is a type of ransomware.”
Episode
23 December 2025 Official episode · Official transcript
incident response
The episode describes ransomware incidents affecting a manufacturing company and a hospital, and discusses ThreatLocker’s deny-by-default application control and zero-trust approach.
Topics: Ransomware encryption and enterprise impact, Application control and application allow-listing, Deny-by-default security, Zero-trust architecture, Endpoint detection and response, Managed detection and response, Multi-factor authentication, VPN-based initial access, Credential theft and dark-web credential sales, Lateral movement across connected networks, Defense in depth, Incident response and restoration from backups, Network isolation during ransomware recovery, Remote-access tools as attack vectors
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Kanti VARIANT_OF Ransomware
Jack describes Kanti as a type of ransomware.
Explicit Confidence 99% · Jack Rhysider EP 167 Details
“Kanti is a type of ransomware.”
ThreatLocker manufacturing ransomware incident INVOLVES Kanti
The manufacturing-company incident involved Kanti ransomware, which renamed files with the .kanti extension and encrypted systems.
Explicit Confidence 99% · Guest EP 167 Details
“they all end in the word .kanti”
“in the space of fifteen minutes it encrypted all 250 servers”
ThreatLocker manufacturing ransomware incident INVOLVES Windows
The manufacturing-company incident encrypted all 250 Windows servers.
Explicit Confidence 98% · Guest EP 167 Details
“Yes, they were all Windows servers”
Hunter Clark MEMBER_OF Ark Technology Consultants
Hunter Clark identifies himself as a cybersecurity engineer at Ark Technology Consultants.
Explicit Confidence 98% · Hunter Clark EP 167 Details
“I’m one of the cybersecurity engineers at Ark Technology Consultants”
Hunter Clark MEMBER_OF Ark Technology Consultants
Hunter Clark is a cybersecurity engineer at Ark Technology Consultants.
Explicit Confidence 98% · Hunter Clark EP 167 Details
“I’m one of the cybersecurity engineers at Ark Technology Consultants”
ThreatLocker hospital ransomware incident INVOLVES ThreatLocker
Ark’s team installed ThreatLocker on the hospital’s servers and computers, and ThreatLocker later blocked tools the threat actor attempted to use.
Explicit Confidence 98% · Jack Rhysider EP 167 Details
“we brought in ThreatLocker, installed it on all the servers and computers”
“ThreatLocker had blocked the solutions that the threat actor had planned on leveraging”
ThreatLocker hospital ransomware incident INVOLVES EDR
The hospital incident involved an EDR/MDR solution that detected activity in the environment.
Explicit Confidence 98% · Hunter Clark EP 167 Details
“we got a call from the EDR/MDR solution that we were using that there was someone in the environment”
ThreatLocker hospital ransomware incident INVOLVES AnyDesk
ThreatLocker blocked AnyDesk, which the threat actor planned to leverage.
Explicit Confidence 98% · Hunter Clark EP 167 Details
“ThreatLocker had blocked the solutions that the threat actor had planned on leveraging, such as AnyDesk and rclone”
ThreatLocker hospital ransomware incident INVOLVES rclone
ThreatLocker blocked rclone, which the threat actor planned to leverage.
Explicit Confidence 98% · Hunter Clark EP 167 Details
“such as AnyDesk and rclone”
ThreatLocker hospital ransomware incident INITIAL_ACCESS_VIA VPN
The threat actor obtained domain-administrator credentials from the dark web and used them to remotely access the environment through the VPN.
Explicit Confidence 99% · Hunter Clark EP 167 Details
“was able to just remote in through the VPN”
ThreatLocker hospital ransomware incident INVOLVES Windows
The threat actor gained access to a Windows server and attempted to infect it with ransomware.
Explicit Confidence 97% · Jack Rhysider EP 167 Details
“gained access to a Windows server, tried to infect it with ransomware”
ThreatLocker hospital ransomware incident INVOLVES Ransomware
The hospital incident involved an attempted ransomware infection and ultimately a ransom demand and payment.
Explicit Confidence 98% · Jack Rhysider EP 167 Details
“tried to infect it with ransomware, but ThreatLocker denied it”
“this hospital system did end up paying the ransom”
Ark Technology Consultants USES ThreatLocker
Hunter says he and his team at Ark brought ThreatLocker into the hospital environment they were securing.
Explicit Confidence 90% · Jack Rhysider EP 167 Details
“we brought in ThreatLocker, installed it on all the servers and computers”
ThreatLocker DEVELOPED_BY Danny Jenkins
Danny says he is ThreatLocker’s CEO and co-founder and that he coded its first version.
Explicit Confidence 99% · Danny Jenkins EP 167 Details
“I’m Danny Jenkins. I’m CEO and co-founder of ThreatLocker”
“I coded the first of it. So, I coded the first version”
Danny Jenkins MEMBER_OF ThreatLocker
Danny identifies himself as CEO and co-founder of ThreatLocker.
Explicit Confidence 99% · Danny Jenkins EP 167 Details
“I’m CEO and co-founder of ThreatLocker”
ThreatLocker USES application control
ThreatLocker is presented as providing application control by preventing unapproved applications from running.
Explicit Confidence 98% · Jack Rhysider EP 167 Details
“what ThreatLocker does is it says, okay, let’s start by blocking every app from opening and running”
ThreatLocker USES application allow-listing
ThreatLocker uses application allow-listing: applications are learned and added to an allow list before secure mode is enabled.
Explicit Confidence 98% · Jack Rhysider EP 167 Details
“you add those apps to the allow list”
ThreatLocker USES deny by default
ThreatLocker is described as blocking everything by default unless the application is permitted.
Explicit Confidence 98% · Danny Jenkins EP 167 Details
“I want to change the way the world thinks about security from default allow to default deny”
“we’re gonna block everything”
ThreatLocker ASSOCIATED_WITH zero-trust
Danny presents ThreatLocker’s deny-by-default and access-granting model as a way to implement zero-trust principles.
Explicit Confidence 96% · Danny Jenkins EP 167 Details
“we can deploy application control. We can block software by default”
“We want to change the market so that ninety percent of the world are using a zero-trust approach”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:49:49.172886+00:00