Episode
01 January 2018 Official episode · Official transcript
advanced persistent threat
The episode presents an anonymized account of a government cyber operation conducted through reconnaissance, weaponization, exploitation, installation, command and control, and attempted data collection.
Topics: Cyber kill chain phases, Nation-state offensive cyber operations, Passive reconnaissance and network mapping, Open-source intelligence, Targeting packages and operational approval, Exploitation of unpatched internet-facing servers, Credential capture and authenticated-session abuse, Lateral movement, Implant deployment, Command and control, Operational security and clandestine access, Implant compatibility failures after an operating-system upgrade, Incident response and system reimaging, Database access and network segmentation
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Nation State Actor ASSOCIATED_WITH Central Intelligence Agency
Nation State Actors are described as hacking groups operating inside government agencies; the CIA is given as an example of a U.S. intelligence agency.
Explicit Confidence 82% · Jack Rhysider EP 10 Details
“the hacking groups that are inside government agencies, otherwise known as Nation State Actors”
“The US has the Central Intelligence Agency and the National Security Agency and others.”
Nation State Actor ASSOCIATED_WITH National Security Agency
Nation State Actors are described as hacking groups operating inside government agencies; the NSA is given as an example of a U.S. intelligence agency.
Explicit Confidence 82% · Jack Rhysider EP 10 Details
“the hacking groups that are inside government agencies, otherwise known as Nation State Actors”
“The US has the Central Intelligence Agency and the National Security Agency and others.”
Nation State Actor USES Cyber kill chain
The anonymous operator describes planning and conducting the operation through the phases of the cyber kill chain.
Explicit Confidence 96% · Jack Rhysider EP 10 Details
“The cyber kill chain. This describes the different phases of a cyber-attack.”
Nation State Actor USES Reconnaissance
The operator performs passive reconnaissance and network mapping to identify exposed systems, software, and access vectors.
Explicit Confidence 98% · Nsa EP 10 Details
“now it’s things like passive reconnaissance and mapping”
Nation State Actor USES Open-source intelligence
The operator uses publicly available information from social networks, search engines, Reddit, and technical forums to map personnel and infrastructure.
Explicit Confidence 99% · Nsa EP 10 Details
“I have a team of people – I have like, fifteen people who do nothing other than spend eight hours a day for six to eight weeks, searching, scouring the internet”
“we had done a month of open-sourced research”
Nation State Actor USES Weaponization
After reconnaissance, the operator derives the tools and exploits to use and obtains operational approval for them.
Explicit Confidence 97% · Jack Rhysider EP 10 Details
“We now move on to Phase Two of the cyber kill chain; weaponization.”
“with those data points, I derive the tools and exploits that I need to use”
Nation State Actor USES Known exploit
The operator uses a known exploit against an unpatched, internet-facing web server to gain access.
Explicit Confidence 99% · Nsa EP 10 Details
“I was able to actually use the known exploit to gain the right access to that machine.”
Known exploit AFFECTS Apache Tomcat
The known exploit is directed at an internet-facing web server running Apache Tomcat; the exact vulnerability is not identified.
Derived Confidence 78% · Nsa EP 10 Details
“a web server that potentially has vulnerabilities I can exploit”
“like Apache Tomcat running on it”
Known vulnerability AFFECTS Apache Tomcat
The transcript links the unpatched Apache Tomcat web server with exploitable vulnerabilities, but does not specify a particular vulnerability.
Derived Confidence 80% · Jack Rhysider EP 10 Details
“the web server was not fully patched, which means the team can use a known vulnerability to access it”
“Apache Tomcat running on it”
Nation State Actor USES Implant
The operator installs an implant on the compromised web server and later on an administrator's machine to maintain remote access.
Explicit Confidence 99% · Nsa EP 10 Details
“Once I did that, I put an implant down on that machine”
“we put the implant on his machine”
Nation State Actor USES Credential capture
The operator plans to capture an administrator's credentials when the administrator logs into the compromised server.
Explicit Confidence 99% · Nsa EP 10 Details
“I’m probably going to be able to capture his credentials”
Nation State Actor USES lateral movement
The operator moves laterally from the compromised web server to the administrator's machine using credentials or an authenticated session.
Explicit Confidence 99% · Nsa EP 10 Details
“I’m probably going to be able to float across that authenticated session and move laterally to the admin’s machine.”
“We get the information that we need and move laterally onto his machine”
Nation State Actor USES Installation
The operator installs the implant on the target system after moving to the administrator's machine.
Explicit Confidence 99% · Jack Rhysider EP 10 Details
“You just heard the fifth phase of the cyber kill chain; installation. We’ve just installed an implant on the target system.”
Nation State Actor USES Command and control
The implant provides remote interactive access to the administrator's computer, which the episode identifies as command and control.
Explicit Confidence 99% · Jack Rhysider EP 10 Details
“we now have the ability to remotely access the network admin’s computer. This is our command and control over the target computer.”
Implant AFFECTS Windows 2012
The implant caused visible, abnormal Windows behavior after the administrator upgraded to a newer operating-system version; the exact newer version is not stated.
Derived Confidence 68% · Nsa EP 10 Details
“the implant worked from the extent of it went down, installed where it should have, and began operating as expected. The problem was that it wasn’t playing well with the newer version of Windows”
Nation State Actor TARGETS Peruvian Ministry of Foreign Affairs
The Peruvian Ministry of Foreign Affairs is presented as a random example target; Jack explicitly says the actual target will remain anonymous.
Uncertain Confidence 93% · Jack Rhysider EP 10 Details
“for this story, let’s pick a random country to use as an example target”
“Let’s go with the Peruvian Ministry of Foreign Affairs.”
“The actual target will remain anonymous.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-12T18:03:22.899069+00:00