Darknet Diaries in 3 minutes

Here is The Daily FM summary of the Darknet Diaries that aired on Tuesday October 6th. This episode traced the rise, exposure, and collapse of Conti, one of the most destructive ransomware groups ever, through its evolution from earlier Russian cybercrime outfits including Dyre and TrickBot.

Jack Rhysider and journalist Geoff White describe Conti less like a loose gang and more like a corporate empire: it recruited through ordinary job sites, ran departments and budgets, employed remote workers, and built a sprawling affiliate network. Its alleged leader used aliases including Bentley and Stern, later identified by authorities as Russian national Vitaly Kovalev. The group’s money laundering was especially surreal. Bentley allegedly created a Moscow film company, produced real movies including one starring Keanu Reeves, and even planned a film called Botnet about Russian hackers—based on the gang operating in the same building.

One recruit, a Latvian programmer known as Max, believed she had landed a stable coding job. Only after starting did she see that she was designing ransomware-note websites. She rationalized that she was “just coding,” but became increasingly involved. Poor operational security—using her own name and online presence—helped authorities identify her. After overstaying a visa in South America, she was routed through Miami and arrested, becoming the first Conti-linked figure taken down.

Conti’s damage was devastating. In 2021, attackers infiltrated Ireland’s public health system through a phishing email, then encrypted around 70,000 computers across thousands of locations during the pandemic. Hospitals reverted to pen and paper; treatments, including cancer care, were delayed. Ireland refused to pay the $20 million ransom, and in a still-unexplained move, Conti eventually supplied a decryptor for free. [1]

The gang also pioneered “double-dip” extortion: steal data first, then encrypt systems, so backups alone cannot solve the crisis. When luxury jeweler Graff delayed paying, Conti leaked customer records, accidentally exposing Saudi royal family details. In an astonishing reversal, the gang apologized publicly, withdrew the material, and promised better review procedures—apparently frightened by the consequences of angering extremely powerful people.

Cybersecurity researcher Alex Holden infiltrated TrickBot and Conti’s ecosystem by building relationships with criminals and exploiting their terrible passwords. One access credential was reportedly “123456,” while another merely added an “A.” The resulting chat logs showed internal disputes, especially over attacks on hospitals, and revealed an organization increasingly chaotic after Stern disappeared.

The turning point came with Russia’s invasion of Ukraine. Conti publicly backed Russia, splitting its own Russian and Ukrainian members. A Ukrainian IT specialist then leaked tens of thousands of Conti’s internal messages, crypto details, organizational records, and member information. The hackers had been hacked. While the disclosure exposed criminals and aided law enforcement, Holden argues it also splintered Conti into harder-to-track groups.

Conti’s final major blow struck Costa Rica, disrupting government services, trade, payroll, and pensions so severely that the country declared a state of emergency. The group then faded, but its affiliates and tactics spread elsewhere. The episode’s grim conclusion is that Conti may be gone as a brand, yet its people, code, and business model live on. Thank you for listening to Darknet Diaries in 3 minutes from The Daily FM. See you next time!

Here is The Daily FM summary of the Darknet Diaries that aired on Tuesday September 22nd. Jack Rhysider stepped away from the usual Darknet Diaries format to talk about a separate, highly personal reporting project called Low. Rather than revealing the full story, he focused on why it affected him so deeply and why it took so long for him to decide to release it.

Low centers on a man from Russia named Zachariah. Jack says Zachariah told him a story so dark, strange, and emotionally overwhelming that it surpassed anything he had previously covered. The account was not presented as a neat cybercrime case or a straightforward technical investigation. Instead, Jack described it as a human story with disturbing implications—one that repeatedly left him shaken after their conversations. [1]

Jack’s central point was that some stories are more than entertainment. He compared the experience of encountering this one to seeing a film that changes the feeling of ordinary life afterward: you sit in your car, drive without a destination, or need time alone simply to process what you have heard. He said Zachariah’s story “opened” something in him, and that his goal with Low was to create an experience that could do something similar for listeners who connect with it. [2]

The reporting itself appears to have been extensive. Jack spoke to Zachariah over many months, revisiting events and details repeatedly because he had questions and wanted a fuller understanding. But the project took a dramatic turn when Zachariah suddenly stopped answering messages and calls. Jack says he vanished while the story was still being recorded, leaving the central question unresolved: what happened to him? [3]

That disappearance became one of the project’s defining tensions. Jack was left holding an extraordinary account from a person he could no longer reach, along with serious uncertainty about whether sharing it was the right thing to do. He says he grappled with that decision for seven years. In his telling, the long delay was not about production logistics alone; it reflected an ethical and emotional struggle over how to handle material that felt unusually heavy, personal, and potentially dangerous.

The notable surprise is how plainly Jack admits that Low may not appeal to every Darknet Diaries listener. He says it does not fit comfortably within the show’s established focus and sits somewhat outside his normal work. But he also argues that, for the audience it is meant to reach, it may land with unusual force. The project is presented as a finite five-episode series, built around a subject whose story appears unresolved both on the page and in real life.

The overarching takeaway is that Low is Jack’s attempt to confront the responsibility of telling a story when the storyteller has been changed by it, the subject has disappeared, and certainty is impossible. Thank you for listening to Darknet Diaries in 3 minutes from The Daily FM. See you next time!

Here is The Daily FM summary of the Darknet Diaries that aired on Tuesday September 1st. Jack Rhysider revisited one of the show’s most infamous stories: two authorized penetration testers who broke into Iowa courthouses for a security assessment, only to be arrested and charged as burglars. The revisit adds the remarkable ending that was missing when the story first aired in 2020.

The testers, Justin Wynn and Gary DeMercurio, now known as Gabby, worked for security firm Coalfire. The Iowa Judicial Branch hired their company to test physical and network security at several facilities. Their written rules of engagement allowed methods such as tailgating, lock-picking, dumpster diving, and placing remote network devices, while specifically forbidding them from disabling alarms. They had signed authorization paperwork and contact numbers for the state officials who commissioned the work.

Their job was essentially to think like intruders, identify weaknesses, and document them before criminals could exploit them. Along the way, they found alarming flaws: doors that could be bypassed, insufficient alarm coverage, and even a courthouse where they could sneak past guards while using camera blind spots. One memorable detail was the simplicity of some physical attacks: Gabby explained that a thin plastic cutting board, carefully cut and manipulated against a door latch, can defeat many commercial crash-bar doors.

The trouble began at the historic Dallas County Courthouse in Adel, Iowa. They found a door unexpectedly open, closed it, then re-entered through a bypass. This time the alarm sounded exactly as intended. Rather than flee, they waited to see whether law enforcement would respond, which was useful information for the client. Deputies arrived quickly, and initially treated them professionally. The testers calmly showed IDs and their authorization letter, and a state contact reportedly confirmed that they were conducting security testing.

Then the county sheriff arrived, rejected their explanation, and ordered their arrest. The mood changed instantly. Despite their paperwork, they were booked for burglary and possessing burglary tools, held overnight in jail, put in orange jumpsuits, and marched in shackles back to the same courthouse the next morning. The judge was openly skeptical, raised their bail from $5,000 to $50,000 each, and they faced felony charges carrying up to seven years in prison.

The central argument of the episode is that a bureaucratic dispute between state and county authorities became a devastating criminal case against two workers who believed they were following a legitimate contract. The state judicial branch had authorized the test, but county officials argued that the state could not authorize a break-in at a county-owned building. A later independent investigation concluded the state did have authority because it operated from the courthouse. Still, prosecutors pursued the case for months before finally dropping all charges.

That did not erase the harm. Gabby and Justin said the arrest record hurt their careers, created constant stress, and made future employers wary. They later left Coalfire and helped build Kaiju Security, their own offensive-security company.

The most surprising update is that they sued the county and the sheriff’s office. Qualified and sovereign immunity prevented them from suing many of the officials personally, and the case dragged on for years. But shortly before trial, the county settled for $600,000 total, or $300,000 each. Justin emphasized that the bigger victory was legal precedent: authorized hackers and penetration testers now have a clearer example of how badly things can go when authorities misunderstand their work, and of the consequences for mishandling it. Thank you for listening to Darknet Diaries in 3 minutes from The Daily FM. See you next time!

Here is The Daily FM summary of the Darknet Diaries that aired on Thursday August 6th. Jack Rhysider used this brief installment to introduce a new long-form project called Low, centered on a man named Zachariah and a story Jack says became the most difficult he has ever reported. [1]

Rather than delivering a typical standalone cybercrime investigation, Jack explained the unusual history behind the project. Zachariah had told him an account of his life that Jack described as wild, brutal, dark, and often hard to believe. Jack says the details were so disturbing and complicated that he kept returning to Zachariah for more interviews, ultimately spending dozens of hours speaking with him across roughly a year. He was not simply looking for dramatic moments; he was trying to verify details, understand Zachariah’s motivations, and figure out how the events fit together. [2]

The central mystery, and the episode’s most striking point, is that Zachariah suddenly disappeared in the middle of that reporting. Calls and messages went unanswered. Weeks turned into months, then years. By the time Jack recorded this trailer, he said it had been eight years since he last heard from Zachariah. That silence left the project with an unresolved real-world question: what happened to the person at the center of the story, and whether he is safe or even reachable now. [3]

Jack described being pulled in opposite directions over whether the material should ever be released. On one side, the story was evidently compelling enough that he felt it needed to be told. On the other, its subject matter was so emotionally heavy that he repeatedly questioned whether publishing it was responsible. That tension appears to be one of the defining features of Low: it is not framed as a clean, solved case with a tidy conclusion, but as an attempt to make sense of a volatile person and an unsettling story whose narrator vanished.

He also emphasized the extraordinary amount of time involved. Although the interviews happened years ago, Jack said it took him years to shape the account into a finished production. Even after he considered it complete, he spent about another year refining it rather than rushing it out. He said he could only work on it when he was in the right emotional state, suggesting that the material affected him personally in a way most Darknet Diaries investigations had not. [4]

The main takeaway from this trailer is that Low is being presented as a deeply reported, human-focused story rather than a conventional technical hacking episode. The notable surprise is not a disclosed plot twist, since Jack intentionally kept the specifics under wraps, but the scale of his commitment: dozens of interview hours, years of editorial work, and an eight-year absence from the subject himself. Jack’s message was that the story stayed with him because it was difficult, unresolved, and unlike anyone he had encountered before. [5]

Thank you for listening to Darknet Diaries in 3 minutes from The Daily FM. See you next time!

Here is The Daily FM summary of the Darknet Diaries that aired on Tuesday August 4th. This episode told the story of Nicholas Sharp, a Ubiquiti cloud engineer who turned his own company’s weak security practices into both a personal crusade and a criminal extortion scheme.

Jack opened with a strange little confession from someone who stole sandwiches from an office fridge, mostly for the thrill of getting away with it. It was not directly connected to the main case, but it set up the episode’s real question: when does someone cross the line from bending rules to doing real harm? [1]

The main story followed Nick Sharp, who had worked at AWS before joining Ubiquiti in 2018. Ubiquiti makes networking gear like routers, switches, and cameras, and Nick quickly rose through the company’s cloud team. He was smart, ambitious, and reportedly eager to find security problems, sound the alarm, and then be seen as the person who fixed them. By 2020 he was making about $250,000 a year, but he felt underpaid, underappreciated, and frustrated that leadership was not listening to his warnings.

Jack framed Nick’s mindset against the ransomware panic of that period. Companies like CWT and Garmin had been hit hard, with rumors of multimillion-dollar ransom demands. Nick watched these stories and became convinced Ubiquiti was vulnerable too. He believed the company had poor logging, overly broad credentials, weak access controls, and too much trust in shared accounts. The surprising part is that, in some technical ways, he was right. But instead of responsibly escalating the problem, he decided to prove it by becoming the attacker.

Using his normal work access, Nick found powerful credentials in Ubiquiti’s AWS environment. Then, through a Surfshark VPN, he logged in as if he were an outside hacker. He later accessed Ubiquiti’s GitHub repositories and downloaded a huge amount of private source code and development history to his personal computer. During the attack, his home internet cut out, and despite using a VPN kill switch, his real home IP address was eventually logged. That small failure became one of the key clues against him.

Afterward, Nick tried to cover his tracks by changing AWS log retention and renaming sessions to make them look like they belonged to other employees. Then, when Ubiquiti noticed suspicious activity, he was brought onto the internal investigation team. So the person helping investigate the breach was also the person who caused it.

The scheme escalated when Ubiquiti executives received a ransom demand for 25 bitcoin, worth about $2 million at the time, with another 25 bitcoin requested for information about an alleged backdoor. Ubiquiti did not pay. Nick tried to pressure the company by uploading stolen data to Keybase, but Ubiquiti got it removed.

One of the most damaging moments came later, when Nick anonymously contacted journalist Brian Krebs, presenting himself as a whistleblower. He claimed Ubiquiti had downplayed the breach and misled customers, which partly echoed real concerns about the company’s public statement. Krebs published the story, customers panicked, and Ubiquiti’s stock dropped sharply, wiping out billions in market value.

Eventually, forensic investigators connected the incident to Nick’s home network and a personal MacBook. The FBI searched his house, and although Nick claimed he was being framed, he was later arrested. In 2023, he pleaded guilty to damaging protected computers, wire fraud, and lying to the FBI. At sentencing, he tried to recast the whole thing as an unauthorized security drill meant to help Ubiquiti improve, but the judge did not buy it. He was sentenced to six years in prison.

The big takeaway was that being right about security problems does not justify creating a breach, extorting your employer, framing coworkers, or lying to investigators. Nick wanted to be treated like the hero who saw the danger first, but by trying to force the company to listen, he became the insider threat he had warned them about. Thank you for listening to Darknet Diaries in 3 minutes from The Daily FM. See you next time! [2]

Here is The Daily FM summary of the Darknet Diaries that aired on Tuesday July 21st. This episode centered on one of the most personal and disturbing consequences of data exposure: identity theft, and how an obscure data broker called National Public Data became tied to a massive breach affecting hundreds of millions of people.

Jack opened with a story from 1988 that set the emotional tone. A homeless man named William Woods had his wallet stolen by a coworker, Matthew Kierans. Inside were documents like a birth certificate and Social Security card. Matthew used them to slowly become William Woods, building a life under that name for decades: a marriage, kids, a job, bank accounts, even a house loan. The real William lived mostly off the grid, so the fraud went unnoticed until 2019, when he discovered accounts in his name. In an almost unbelievable twist, the bank and police believed Matthew, because he had decades of paperwork, and treated the real William as the impostor. William was sent to a mental hospital, forced to take psychiatric drugs, jailed, and billed $118,000 before DNA finally proved he was the real William Woods. Matthew was later sentenced to 12 years in federal prison. Jack used this as a warning: with enough personal data, someone can effectively steal your life. [1]

The episode then shifted to the hacker known as “USDoD,” later identified as Luan Barbosa from Brazil. Jack described him as erratic, theatrical, and hard to verify, with a strange origin story involving a vanished hospital worker in New York and a supposed vendetta against the United States. Whether true or not, Luan became known for breaching government-adjacent targets. He allegedly helped steal data from U.S. military-related systems, then faked his way into the FBI-linked InfraGard system by impersonating a CEO and scraping contact information for tens of thousands of members.

The National Public Data story came through another character: Salvatore Verini Jr., or Sal, a former Florida deputy who wanted to make TV shows. Jack painted him as someone chasing an entertainment dream while funding it through a data broker business. Sal’s company collected huge amounts of personal information from public records, scraped sources, marketing lists, and other brokers, then sold people-search access. The surprising part was how flimsy the operation appeared: little money in the bank, no cybersecurity budget, and sensitive systems run from home equipment.

That weakness became catastrophic when Luan found an exposed file on one of Sal’s sites containing source code and admin credentials. Because passwords were reused, he accessed National Public Data and stole roughly 277 gigabytes, including billions of lines of names, birthdays, Social Security numbers, addresses, emails, and phone numbers. He tried to sell it online for millions.

Jack’s takeaway was angry and clear: data brokers collect information without real consent, profit from it, and often face limited consequences when it leaks. He noted that Congress briefly considered a major privacy bill after many lawmakers were exposed too, but lobbying weakened it until it died. His practical advice was to assume no one is coming to protect your privacy: use Signal, encrypted email, and privacy-focused browsers, and reduce what companies can collect about you. The most shocking through-line was how a forgotten wallet theft, a reckless data broker, and one hacker’s ego all pointed to the same danger: once your identity data is loose, getting your life back can be nearly impossible. Thank you for listening to Darknet Diaries in 3 minutes from The Daily FM. See you next time!