Lior says he was assigned to and served in Unit 8200 for six years.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“Lior was assigned to work in Unit 8200.”
“After six years in the army, I went to the university.”
Episode
06 April 2021 Official episode · Official transcript
research
The episode features Cybereason CEO Lior Div and threat researcher Assaf Dahan discussing Unit 8200, cyber operations, Cybereason’s Malop detection approach, and the investigation of the Molerats threat actor and its Spark, SharpStage, and DropBook malware.
Topics: Malicious-operation and behavior-centric detection, Endpoint detection, prevention, and response, Real-time in-memory graph processing, Threat intelligence and malware reverse-engineering, Phishing with executable decoy documents, Command and control through social-media accounts, Cloud-service abuse for malware hosting and data exfiltration, Sandbox evasion through language checks, Lateral movement and persistence, Cyber espionage and attribution
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Lior says he was assigned to and served in Unit 8200 for six years.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“Lior was assigned to work in Unit 8200.”
“After six years in the army, I went to the university.”
Lior Div MEMBER_OF Cybereason
Lior identifies himself as the CEO and co-founder of Cybereason.
Explicit Confidence 99% · Lior Div EP 89 Details
“I’m Lior Div, the CEO and co-founder of Cybereason.”
Nocturnus PART_OF Cybereason
Nocturnus is described as a team inside Cybereason.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“There’s this team inside Cybereason which is called Nocturnus.”
Assaf Dahan MEMBER_OF Nocturnus
Assaf says he heads the Nocturnus Threat Research Team at Cybereason.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“I am heading the Nocturnus Threat Research Team at Cybereason.”
Malop DEVELOPED_BY Cybereason
Lior says Cybereason invented the Malop, or malicious operation, approach.
Explicit Confidence 99% · Lior Div EP 89 Details
“Basically, we invented the new method and the method is operation-centric. We call it the Malop, the malicious operation approach.”
in-memory graph processing DEVELOPED_BY Cybereason
Lior describes in-memory graph processing as the technology built as the secret behind Cybereason.
Explicit Confidence 98% · Lior Div EP 89 Details
“This is a in-memory graph processing technology, that this is kind of the secrets behind Cybereason.”
Cybereason USES behavioral detection
Cybereason's detection approach looks for malicious indicators of behavior rather than only known compromise indicators.
Explicit Confidence 98% · Assaf Dahan EP 89 Details
“we started looking for malicious indicators of behavior which are signs that a malicious actor is conducting their operation.”
“mostly behavior – is based on behavioral detection.”
Jack describes Stuxnet as attacking an Iranian nuclear enrichment facility.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“this was an attack on an Iranian nuclear enrichment facility in order to thwart their enrichment process.”
The Stuxnet attack is described as targeting Iran's nuclear enrichment facility.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“this was an attack on an Iranian nuclear enrichment facility”
Jack says circumstantial evidence indicates that Israel, along with the United States, was behind Stuxnet; the attribution is not presented as certain.
Uncertain Confidence 75% · Jack Rhysider EP 89 Details
“the circumstantial evidence shows that the US and Israel were behind this attack.”
Molerats TARGETS Palestinian Authority
Assaf says the group targeted political figures within the Palestinian Authority.
Explicit Confidence 98% · Assaf Dahan EP 89 Details
“they targeted political figures within the Palestinian authority”
Assaf says the targeted Palestinian Authority figures were associated with Fatah, and that the group targets political figures and entities in the region.
Explicit Confidence 96% · Assaf Dahan EP 89 Details
“political figures within the Palestinian authority that associated with Fatah”
The episode describes Molerats as mostly targeting people in Palestine and Israel, including political figures.
Explicit Confidence 96% · Jack Rhysider EP 89 Details
“They have mostly targeted people in Palestine and Israel”
Molerats' campaigns are described as sending targeted phishing emails and documents to victims.
Derived Confidence 97% · Assaf Dahan EP 89 Details
“the operators sent a phishing PDF to their victims.”
“specific individuals were sent these phishing e-mails”
Assaf assesses with moderate to high confidence that Molerats was likely behind the campaign in which Spark was discovered; attribution is hedged.
Uncertain Confidence 82% · Assaf Dahan EP 89 Details
“you can say that with, I don’t know, moderate to high confidence that it’s likely Molerats who is behind it.”
Spark USES Data exfiltration
Spark can be used to steal and harvest information from a victim endpoint.
Explicit Confidence 96% · Assaf Dahan EP 89 Details
“They can run different commands, they can use it to steal information”
“basically harvest any information.”
SharpStage USES Dropbox
SharpStage implements a Dropbox client to exfiltrate information.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“the exfiltration method is using a Dropbox client”
SharpStage USES Data exfiltration
SharpStage uses Dropbox as its method for exfiltrating data.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“the exfiltration method is using a Dropbox client”
SharpStage USES sandbox evasion
SharpStage checks whether Arabic is installed and will not run without it, which Assaf describes as a way to avoid sandboxes.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“it’s also a clever way to avoid most sandboxes”
DropBook exfiltrates data through Dropbox.
Explicit Confidence 97% · Jack Rhysider EP 89 Details
“it exfiltrates that data through Dropbox.”
DropBook uses fake Facebook accounts to receive commands through posts.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“They actually used a Facebook fake account”
“they actually implemented a C2 communication channel using Facebook fake accounts”
DropBook USES Command and control
DropBook implements a command-and-control channel using fake Facebook accounts.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“they actually implemented a C2 communication channel using Facebook fake accounts”
DropBook USES Data exfiltration
DropBook is described as exfiltrating victim data through Dropbox.
Derived Confidence 95% · Jack Rhysider EP 89 Details
“it exfiltrates that data through Dropbox.”
Molerats SAME_AS Gaza Cyber Gang
Jack reports that FireEye calls the group Molerats while Kaspersky calls the same group the Gaza Cyber Gang.
Attributed Confidence 93% · Jack Rhysider EP 89 Details
“FireEye calls this group Molerats but Kaspersky calls this same group the Gaza Cyber Gang.”
Molerats ASSOCIATED_WITH Hamas
Jack's research leads him to conclude that Molerats is somehow allied with Hamas, but he explicitly says the connection is uncertain.
Uncertain Confidence 72% · Jack Rhysider EP 89 Details
“my conclusion is that Molerats is somehow allied with Hamas.”
“I’m not sure to what degree Molerats might be connected with Hamas, if at all.”
Jack says reports show Molerats targeting Fatah but not members of Hamas.
Attributed Confidence 91% · Jack Rhysider EP 89 Details
“they do target Fatah.”
Cybereason USES endpoint detection and response
Cybereason operates in the endpoint detection and response space and deploys sensors on endpoints to detect and prevent malicious activity.
Explicit Confidence 99% · Lior Div EP 89 Details
“Today, Cybereason is operating in the EPP world; EDR, XDR, and NDR.”
“it started by deploying the sensor on every endpoint that the company has.”
Cybereason USES in-memory graph processing
Cybereason collects endpoint data and analyzes it in real time using graph processing.
Explicit Confidence 99% · Lior Div EP 89 Details
“over there we’re running the graph processing in real time.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:58:47.335543+00:00