The Venetian PART_OF Las Vegas Sands
The Venetian is described as being owned by Las Vegas Sands.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“LVS is the company that owns The Venetian and Palazzo in Vegas”
Episode
30 April 2019 Official episode · Official transcript
advanced persistent threat
The episode describes the February 2014 destructive cyber-attack against Las Vegas Sands, including compromise through Sands Bethlehem, credential theft with Mimikatz, access to the Las Vegas network, data theft, website defacement, and deployment of a destructive wiper.
Topics: Destructive wiper malware, Credential dumping from Windows memory, Mimikatz, VPN password brute force, Two-factor authentication, Lateral movement, Privilege escalation, Network persistence, Data exfiltration, Website defacement, Network segmentation and isolation, Incident response, Disconnecting systems to contain malware, Active Directory failure and cross-site connectivity, Nation-state destructive cyber-attacks
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
The Venetian PART_OF Las Vegas Sands
The Venetian is described as being owned by Las Vegas Sands.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“LVS is the company that owns The Venetian and Palazzo in Vegas”
Sands Bethlehem PART_OF Las Vegas Sands
Sands Bethlehem is described as one of the Sands properties associated with Las Vegas Sands.
Explicit Confidence 96% · Jack Rhysider EP 37 Details
“another Sands Casino Resort in Bethlehem”
“One of Sheldon’s properties is called Sands Bethlehem”
Las Vegas Sands cyber-attack INVOLVES Sands Bethlehem
The cyber-attack began with activity against the Sands Bethlehem network and its internet-facing systems.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“the IT team in the Sands [00:15:00] Bethlehem resort saw some worrying activity on their computer network”
Las Vegas Sands cyber-attack INVOLVES brute-force password attack
The attackers attempted hundreds of password combinations against VPN users in a brute-force password attack.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They tried hundreds and hundreds of password combinations to try to get into this VPN”
Las Vegas Sands cyber-attack INVOLVES two-factor authentication
The Sands security team enabled two-factor authentication for VPN users to prevent the password attack from succeeding.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They enabled two factor authentication for VPN users”
Las Vegas Sands cyber-attack INVOLVES Mimikatz
The attackers used Mimikatz on a web development server to obtain usernames and passwords.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They used a tool called Mimikatz”
“these hackers ran Mimikatz on this web development server”
Las Vegas Sands cyber-attack INVOLVES credential dumping
The attackers harvested usernames and clear-text passwords from the web development server using Mimikatz.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“they were able to see the usernames and passwords of web developers and IT admins for Sands Bethlehem”
Las Vegas Sands cyber-attack INVOLVES lateral movement
After compromising one server, the attackers attempted to move laterally and escalate privileges across the network.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“you now need to figure out how to laterally move or escalate your privileges”
Las Vegas Sands cyber-attack INVOLVES persistence
The attackers established a persistent connection so they could retain access if the compromised password changed.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They gave themselves a persistent connection to it in case that password was to change”
Las Vegas Sands cyber-attack INVOLVES Data exfiltration
During the attack, sensitive customer, guest, staff, and gambler data was compressed and downloaded.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“sensitive files were being compressed and downloaded”
“Social security numbers were stolen, drivers license details were stolen”
Las Vegas Sands cyber-attack INVOLVES wiper virus
The attack involved a custom-written Visual Basic wiper code intended to destroy data and spread through the network.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“a wiper code with the goal of destruction”
“This wiper virus was on a mission to infect and spread to as many systems as it could and delete the data”
wiper virus AFFECTS Microsoft Windows
The wiper virus targeted Windows machines and wiped the Windows Active Directory server in Las Vegas.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“targeting just Windows machines”
“the wiper virus hit the active directory server in Las Vegas and completely wiped it out”
Las Vegas Sands cyber-attack COMPROMISES Las Vegas Sands
The cyber-attack compromised Las Vegas Sands' networks, servers, and data and caused extensive operational damage.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“The attack on Las Vegas Sands wiped out almost 75% of the company’s networks and servers”
Las Vegas Sands cyber-attack ATTRIBUTED_TO Iranian government
James Clapper attributed the attack against Las Vegas Sands to Iran; Jack presents this as an official attribution to the Iranian government or military, while noting the broader circumstances and motives were uncertain.
Attributed Confidence 97% · James Clapper EP 37 Details
“2014 saw for the first time destructive cyber-attacks carried out on [00:25:00] US soil by nation state entities marked first by the Iranian attack against the Las Vegas Sands Casino Corporation”
“James Clapper is saying that the people who did it was the Iranian government itself”
Iranian government TARGETS Las Vegas Sands
The Iranian government is attributed with targeting Las Vegas Sands in the destructive cyber-attack, according to James Clapper's Senate testimony.
Attributed Confidence 96% · James Clapper EP 37 Details
“the Iranian attack against the Las Vegas Sands Casino Corporation”
Sony cyber-attack ATTRIBUTED_TO North Korea
James Clapper identifies a North Korean attack against Sony in November 2014.
Attributed Confidence 98% · James Clapper EP 37 Details
“and a North Korean attack against Sony in November”
Moonlight Maze ATTRIBUTED_TO Russia
Jack describes Moonlight Maze as Russia hacking into a US Air Force base.
Explicit Confidence 97% · Jack Rhysider EP 37 Details
“an attack called Moonlight Maze which was Russia hacking into a US Air Force base”
Stuxnet ATTRIBUTED_TO United States
Jack states that Stuxnet was a US attack on Iranian soil.
Explicit Confidence 96% · Jack Rhysider EP 37 Details
“Stuxnet was a US attack on Iranian soil”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:40:13.156717+00:00