Episode
11 January 2022 Official episode · Official transcript
black hat dark web
The episode covers unauthorized access by former employees, sale of stolen customer data, the Ring credential exposure, and insider-threat prevention.
Topics: Former-employee access revocation, Shared credentials in managed service providers, Insider threats, Unauthorized access to client systems, Credential dumps, Dark-web marketplaces and forums, Data theft and sale of customer records, RDP exposure, Ransomware enablement, Bitcoin wallet traceability, Deleting event logs to conceal activity, Internet-connected camera security, Vehicle remote-disable systems, Monitoring during employee termination
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Omar USES Unauthorized access using retained credentials
Omar used another employee's still-active login after his own dealership account had been disabled.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“He was able to use this other employee’s login to access the computers at this car dealership.”
Omar USES Web Tech Plus
Omar accessed the dealership's Web Tech Plus system and used it to disable customers' cars and make them honk continuously.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“The first thing he goes for is their Web Tech Plus system.”
“Omar gets into that system and starts typing customer names that he remembers, and he just starts clicking on them and disabling cars”
Marq experimented with Linux and later checked out BackTrack and its hacking tools.
Explicit Confidence 96% · Jack Rhysider EP 108 Details
“From there, he heard about BackTrack and was drawn to different hacking tools.”
Marq used Tor while in high school, but said he mainly explored it and did not conduct activities there at that time.
Explicit Confidence 98% · Marq EP 108 Details
“I went on Tor a couple of times, but honestly I never did anything.”
Oracle hired Marq after a recruiter found his resume, and he worked there for about a year and a half.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“a recruiter from Oracle found it and reached out, and Oracle hired him.”
“He worked there about a year and a half”
While working at Oracle, Marq supported its point-of-sale software called Micros.
Explicit Confidence 99% · Marq EP 108 Details
“I worked on their point-of-sale software called Micros. I was a support engineer.”
Marq was hired by Microsoft and worked there as an Exchange engineer.
Explicit Confidence 99% · Marq EP 108 Details
“I went through the interviewing process and I was hired. At Microsoft, I was a Exchange engineer”
In his Microsoft role, Marq helped administrators with Exchange issues, including on-premises, cloud, and hybrid setups.
Explicit Confidence 99% · Marq EP 108 Details
“At Microsoft, I was a Exchange engineer, so I helped mostly systems administrator, but I would help them with pretty much any Exchange issue.”
Marq USES Office 365
Marq supported Office 365 issues in his role as a Microsoft Exchange engineer.
Explicit Confidence 97% · Marq EP 108 Details
“it could be Office 365 issues, in the Cloud”
Marq USES PowerShell
A coworker asked Marq to write a PowerShell script for a client, although Marq described it as outside his area.
Explicit Confidence 98% · Marq EP 108 Details
“he wanted me to write a PowerShell script for this specific client that was just way out of my zone.”
Marq USES Unauthorized access using retained credentials
Two months after being fired, Marq used retained credentials to access his former employer's administration portal and customer servers.
Explicit Confidence 99% · Marq EP 108 Details
“I just checked to see if I still had access to one of the servers where we administered several of our clients. I still had access to everything.”
“He had remembered his username and password to get into that dashboard when he worked there, and he tried to log into the portal, and it worked.”
Marq USES Credential dump
Marq downloaded thousands of documents containing customer banking, tax, address, and identity-document information and sold a sample of the data.
Explicit Confidence 94% · Marq EP 108 Details
“that’s when I started to download quite a bit of the information from one of the servers.”
“It was thousands and thousands of documents. I want to say probably 15,000 documents in total.”
Marq USES Event logs
Because he had administrator access, Marq deleted event logs showing his login and download activity to conceal the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“he could just delete the event logs which showed his login and download activities.”
Marq sold access to the stolen data for $600 in Bitcoin and transferred the payment between his wallets.
Explicit Confidence 99% · Marq EP 108 Details
“The $600, of course, was in Bitcoin. Then yeah, they transferred the money to my wallet and I gave them the information they wanted.”
Marq USES Remote Desktop Protocol
Marq planned to create accounts with internet-accessible RDP credentials on additional servers so he could sell access to them.
Explicit Confidence 98% · Jack Rhysider EP 108 Details
“he would make a new user account and give it RDP access from the internet so he could sell that username and password”
Marq verified that credentials posted by other hackers gave access to a real Ring camera account, then reported the exposure.
Explicit Confidence 98% · Marq EP 108 Details
“I did sign onto one of the accounts just to see if I could see through her Ring camera and see if this was real, and it was”
Amazon is described as the parent company for Ring and responded to Marq's report about the exposed accounts.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“Then Amazon, the parent company for Ring, responded to Marq and sorted it out.”
Binary Defense DEVELOPED_BY Dave Kennedy
Binary Defense is described as having been founded by Dave Kennedy.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“a well-known IT security company called Binary Defense, founded by Dave Kennedy”
Binary Defense USES Confidential informant
Binary Defense bought the data on the forum, investigated the seller and victim, and turned the findings over to the FBI; Jack characterizes this role as a confidential informant.
Explicit Confidence 95% · Jack Rhysider EP 108 Details
“they investigate the data to try to figure out who the victim was and who the person is that sold this to them, and then they just turned all that over to the FBI.”
“It’s what’s known as a confidential informant.”
Lisa Forte ASSOCIATED_WITH Insider threat
Lisa Forte consults with companies about handling insider threats and explains the circumstances that can produce them.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“Lisa consults with companies to help them handle insider threats.”
Marq ASSOCIATED_WITH Insider threat
Lisa says Marq was technically an outsider when he acted, but discusses his case as an example of the circumstances and tipping points associated with insider threats.
Attributed Confidence 86% · Lisa Forte EP 108 Details
“in this particular case, I suppose technically at the time he did it, he was an outsider. But it’s no – there’s no bad apple that exists in an organization.”
David Petraeus MEMBER_OF Central Intelligence Agency
David Petraeus is described as having been director of the CIA.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“Petraeus was director of the CIA”
Jack Rhysider AUTHORED Darknet Diaries
Jack identifies himself as the person making the Darknet Diaries show.
Explicit Confidence 99% · Jack Rhysider EP 108 Details
“This show is made by me, a citizen of the Metaverse, Jack Rhysider.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:25:21.527236+00:00