webjedi SAME_AS Amélie Koran
Amélie Koran says that webjedi is her online handle.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“My handle is webjedi although back when I was in the BBS world, it was Thunderball”
Episode
27 April 2021 Official episode · Official transcript
incident response
Amélie Koran describes investigating a major World Bank network intrusion, a related internal information leak, and subsequent security improvements. The episode also discusses her later work involving Heartbleed, the OPM breach, and federal cybersecurity programs.
Topics: Digital forensics and incident response, File integrity monitoring, Hardware security modules and cryptographic material, Forensic imaging and evidence preservation, Log and NetFlow analysis, Lateral movement, Password hashes and password cracking, Enterprise administrator compromise, Multi-factor authentication and smart cards, Active Directory security, Honeypots and insider-leak investigations, Threat attribution using malware and TTPs, Security operations centers and incident-response playbooks, OpenSSL and Heartbleed, OPM network intrusion
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
webjedi SAME_AS Amélie Koran
Amélie Koran says that webjedi is her online handle.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“My handle is webjedi although back when I was in the BBS world, it was Thunderball”
Amélie Koran MEMBER_OF Mandiant
Amélie Koran worked for Mandiant as its first full-time IT manager.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“As their first full-time IT manager.”
Mandiant ASSOCIATED_WITH FireEye
Mandiant was acquired by FireEye.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Recently, they were acquired by FireEye.”
Amélie Koran MEMBER_OF World Bank
Amélie Koran worked as an information security engineer and contractor at the World Bank.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“I was just an information security engineer. I was just basic utility player. I was a contractor”
World Bank network intrusion COMPROMISES World Bank
The incident was a serious breach of the World Bank network.
Explicit Confidence 97% · Jack Rhysider EP 91 Details
“a serious breach in the network of a major bank”
World Bank network intrusion INVOLVES file integrity monitoring
The intrusion was detected after file integrity monitoring indicated unauthorized changes on a server.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“the file integrity monitor triggered an alert and it showed that someone had made changes to a server”
World Bank network intrusion INVOLVES hardware security module
One of the systems touched during the intrusion was the World Bank's hardware security module, described as holding cryptographic material.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“one of the machines that got touched was our HSM”
World Bank network intrusion INVOLVES Forensic imaging
Investigators created forensic images of affected servers and later used remote forensic imaging on a suspect's computer.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had evidence that this attacker had accessed and changed configurations on thirty different servers”
“We could push out our remote forensic imaging element out to them and grab an image of their hard drive.”
World Bank network intrusion INVOLVES lateral movement
The attacker moved laterally from one server to other servers after gaining access.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Once they were in one computer, they were able to traverse the network to get into other computers.”
World Bank network intrusion INVOLVES Active Directory
An enterprise administrator account for Active Directory was compromised during the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“one of our three enterprise admins for AD’s account was compromised”
World Bank network intrusion INVOLVES multi-factor authentication
The bank had abandoned a multi-factor access program before the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had abandoned a multi-factor access program”
World Bank network intrusion INVOLVES smart card authentication
The bank was transitioning from token-based authentication to smart-card authentication when the attackers gained access.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“they were in the process of switching everyone to use smart cards for authentication”
World Bank network intrusion INVOLVES Password cracking
The investigation involved obtaining password hashes and cracking the enterprise administrator password.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“she decided to get the hashes herself and see if she could crack the password”
“was able to pull out the passwords for the enterprise admin rather quickly”
Amélie Koran USES John the Ripper
Amélie Koran used John the Ripper to crack the enterprise administrator's password.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Amélie started John the Ripper, a tool used to crack passwords”
Amélie Koran USES EnCase
Amélie Koran used EnCase and other tools to analyze a suspect's hard drive and reconstruct web caches.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“When we eventually pulled it through using stuff like EnCase and some other tools, reconstruct the web caches”
Amélie Koran USES OmniGraffle
Amélie Koran used OmniGraffle to map the incident's systems, paths, and timeline.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“I’m doing all this stuff in Visio and OmniGraffle, mapping out all the paths”
Amélie Koran USES Visio
Amélie Koran used Visio to map the incident's paths and affected systems.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“I’m doing all this stuff in Visio and OmniGraffle, mapping out all the paths”
Mandiant's early Mirror tool was used in examining material that matched its work mapping Chinese threat actors.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“Mandiant, as part as some of the malware stuff that we had looked at using their Mirror tool”
World Bank network intrusion INVOLVES Honeypot
Investigators planted fake information in a conference room as a honeypot to identify an internal leaker.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“We decided to set up a honeypot.”
“Started writing some fake stuff on the walls; put up some papers on the table”
World Bank network intrusion INVOLVES Mandiant
The World Bank called Mandiant to provide additional incident-response assistance.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“the bank realized they needed even more help, so they called Mandiant up”
World Bank network intrusion ATTRIBUTED_TO China
The attack was not identified with certainty, but clues and some Mandiant analysis suggested it came from China or a Chinese asset.
Uncertain Confidence 88% · Jack Rhysider EP 91 Details
“there were a few clues that suggested that this attack came from China”
“they knew that it was China or some Chinese asset”
Heartbleed AFFECTS OpenSSL
Heartbleed is described as an OpenSSL incident.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Heartbleed, the SSL, the open SSL incident”
OPM breach INVOLVES Office of Personnel Management
The OPM breach involved intrusions on the Office of Personnel Management network.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had found some intrusions on the OPM network”
Darknet Diaries REFERENCES Fox News article: World Bank Under Cyber Siege in Unprecedented Crisis
The episode reads and discusses the Fox News article titled “World Bank Under Cyber Siege in Unprecedented Crisis.”
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Here, I’ll read the article for you. The headline says World Bank Under Cyber Siege in Unprecedented Crisis.”
Fox News article: World Bank Under Cyber Siege in Unprecedented Crisis ASSOCIATED_WITH Fox News
The article was a Fox News report about the World Bank intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“a story that ended up getting leaked to Fox News”
“Someone had spoken to a reporter [00:25:00] at Fox News and told them about this incident.”
World Bank USES smart card authentication
After the incident, the World Bank completed the rollout of smart-card authentication for everyone.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“they finished rolling out that smart card authentication for everyone”
World Bank DEVELOPED_BY Security Operations Center
After the incident, the World Bank built out a security operations center.
Explicit Direction flagged Confidence 97% · Jack Rhysider EP 91 Details
“They built out a SOC, they developed an incident-handling playbook”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:01:24.464392+00:00