173: Tarjeteros

176: NSL

Jul 7, 20261h 6mSummary

In this episode of Darknet Diaries, host Jack Rhysider interviews Nick Merrill, an early internet pioneer who inadvertently became the center of a landmark legal battle over government surveillance. After starting one of the first internet service providers in New York City during the mid-nineties, Merrill’s trajectory changed permanently when he received an unexpected visit from the FBI. He was handed a National Security Letter (NSL), a directive demanding sensitive customer data while imposing a strict gag order that forbade him from disclosing the request to anyone, including his business partners or legal counsel. Merrill recounts his decision to challenge the constitutionality of the NSL, arguing that it violated the First, Fourth, and Fifth Amendments by bypassing judicial oversight and enforcing prior restraint on speech. With the assistance of the ACLU, who recognized the letter as a rare opportunity to challenge a secretive tool of the Patriot Act, Merrill embarked on a decade-long legal fight against the federal government. The episode provides an insightful look into the delicate balance between national security powers and individual constitutional rights in the digital age.

175: Bayrob

Jun 2, 20261h 36mSummary

In this episode of Darknet Diaries, host Jack Rhysider explores the complex investigation of Bayrob, a sophisticated malware gang that defrauded eBay users for years. The episode centers on the investigative work of Liam O’Murchu, a security researcher at Symantec who first encountered the malware while analyzing novel threats. Unlike common cyberattacks, Bayrob utilized a highly intricate proxy chain that routed traffic through thousands of infected machines worldwide to conceal the attackers’ true location. The narrative details the evolution of this digital cat-and-mouse game, highlighting the persistence required to track criminals who actively taunted researchers and utilized advanced obfuscation techniques. The story spans years, covering the collaboration between private sector experts, such as Liam and investigators from AOL, and the FBI. Listeners learn about the challenges of cross-border cybercrime, the frustration of working with encrypted data, and the legal hurdles of the time regarding international information sharing. Ultimately, the episode serves as a compelling case study on the persistence of both the perpetrators and the dedicated professionals working to dismantle one of the most elusive fraud rings of its era.

174: Pacific Rim

May 5, 20261h 30mSummary

In this episode, the podcast explores a multi-year cyber-espionage campaign targeting Sophos, a major provider of network security hardware. The story begins in 2018, when attackers breached a subsidiary, CyberRoam, to gain access to proprietary source code. The investigation revealed a sophisticated, multi-stage operation where actors moved laterally across networks with precision. The situation escalated in 2020 with the discovery of a widespread vulnerability in Sophos firewalls, which allowed hackers to remotely compromise thousands of devices globally. The episode details how Sophos took the unprecedented step of deploying a remote hotfix to patch these devices without direct user intervention—a controversial move that sparks a broader discussion regarding the balance between security, vendor overreach, and user control. Through deep technical analysis and OSINT, security researchers were eventually able to trace the activity back to a specific threat actor in China, identifying how the attackers used virtualized instances of the products to refine their exploits. This episode offers a fascinating look at the high-stakes world of corporate incident response, the long-term persistence of sophisticated threat actors, and the difficult ethical decisions cybersecurity vendors face when protecting their customers at scale.

172: SuperBox

Apr 7, 20261h 27mSummary

In this episode of Darknet Diaries, host Jack Rhysider explores the unsettling reality of malicious hardware hidden in plain sight. The discussion centers on the SuperBox, a seemingly innocuous device marketed as a premium streaming box capable of providing thousands of movies and live TV channels for a one-time fee. Through the investigation of a cybersecurity researcher known as Deadass, the episode reveals how these devices—widely available on major e-commerce platforms—are actually dangerous, backdoored hardware. The investigation uncovers that the SuperBox functions as a sophisticated, internet-connected botnet node. By analyzing network traffic, the researcher discovered the box performing aggressive ARP scans and internal network reconnaissance, essentially acting as a bridge for malicious actors to pivot into corporate or private networks from within the home. Furthermore, the device uses outdated, unpatched Android software and contains remote management tools, allowing unauthorized external access. Because these boxes are frequently purchased for residential use, they represent a significant, overlooked entry point for intelligence gathering and potential large-scale cyberattacks. The episode highlights the alarming ease with which these devices infiltrate suburban households and the complex, ongoing efforts required to track their reach.

170: Phrack

169: MoD

168: LoD

167: Threatlocker

166: Maxie

165: Tanya