MLT felt loosely affiliated with Anonymous and observed activity in its IRC chat rooms; this was not presented as formal membership.
Uncertain Confidence 93% · Jack Rhysider EP 109 Details
“For a while, MLT felt loosely affiliated with Anonymous”
Episode
25 January 2022 Official episode · Official transcript
black hat hacktivism
The episode features MLT describing his teenage involvement with TeaMp0isoN, its hacking activities, the later radicalisation and ISIS affiliation of TriCk/Junaid Hussain, and MLT’s subsequent legal vulnerability research work.
Topics: zero-day exploit development, MyBB exploitation and shell access, website defacement, database exfiltration, Facebook query language exploitation, phishing, malware delivery through email attachments, lateral movement, social engineering and telephone impersonation, Gmail password-reset abuse, WordPress account takeover, SQL injection, email spoofing, DDoS and telephone denial of service, PBX compromise, Asterisk caller-ID spoofing, proxy, VPN, and Tor-based anonymisation, disk wiping with DBAN, malicious Android APKs and geolocation, bug bounty programs, exploit broker markets, responsible vulnerability disclosure
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
MLT felt loosely affiliated with Anonymous and observed activity in its IRC chat rooms; this was not presented as formal membership.
Uncertain Confidence 93% · Jack Rhysider EP 109 Details
“For a while, MLT felt loosely affiliated with Anonymous”
poison.org DEVELOPED_BY TriCk
TriCk was described as the founder, administrator, and moderator of poison.org.
Explicit Confidence 99% · MLT EP 109 Details
“poison.org which TriCk was the administrator of”
MLT MEMBER_OF TeaMp0isoN
MLT joined TeaMp0isoN and was asked to co-lead the group.
Explicit Confidence 99% · MLT EP 109 Details
“I was one of those people. Then he went around to ask if I wanted to help co-lead the group with him.”
TriCk MEMBER_OF TeaMp0isoN
TriCk founded and led TeaMp0isoN after converting poison.org into the hacker group.
Explicit Confidence 98% · Jack Rhysider EP 109 Details
“TriCk wanted to take it up a notch and decided to convert his poison.org website into a hacker group called TeaMp0isoN.”
TeaMp0isoN TARGETS English Defense League
TeaMp0isoN members targeted the English Defense League, including its website and donor database.
Explicit Confidence 99% · MLT EP 109 Details
“The first major hack that I did with TriCk was the English Defense League.”
MyBB zero-day exploit EXPLOITS zero-day vulnerability
The exploit was a zero-day exploit developed to take advantage of a MyBB vulnerability.
Explicit Confidence 97% · MLT EP 109 Details
“We actually developed a zero-day exploit at the time”
MyBB zero-day exploit AFFECTS MyBB
The zero-day exploit affected MyBB and allowed a shell to be spawned on it.
Explicit Confidence 98% · MLT EP 109 Details
“a zero-day exploit at the time that allowed us to spawn a shell on MyBB”
MyBB zero-day exploit DEVELOPED_BY MLT
MLT said that he identified the vulnerability underlying the MyBB zero-day exploit.
Explicit Confidence 96% · MLT EP 109 Details
“It was me that identified the vulnerability”
MyBB zero-day exploit DEVELOPED_BY TriCk
TriCk was the person who exploited the vulnerability to spawn the shell; the episode describes the exploit as jointly developed and used by the pair.
Derived Confidence 78% · MLT EP 109 Details
“it was TriCk that actually exploited the vulnerability to spawn the shell”
TriCk EXPLOITS zero-day vulnerability
TriCk exploited the zero-day vulnerability to spawn a shell on MyBB.
Explicit Confidence 99% · MLT EP 109 Details
“it was TriCk that actually exploited the vulnerability to spawn the shell”
TeaMp0isoN ASSOCIATED_WITH Anonymous
TeaMp0isoN sprang out of Anonymous and was once loosely affiliated with it, but later separated itself from Anonymous.
Uncertain Confidence 94% · Jack Rhysider EP 109 Details
“TeaMp0isoN sort of sprang out of Anonymous and was once loosely affiliated with them”
TeaMp0isoN USES Website defacement
Website defacement was an early objective of TeaMp0isoN's attacks.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“Their early objectives were simply to try to deface their target websites.”
TeaMp0isoN USES phishing
TeaMp0isoN used a phishing email as the initial access method in the hotel compromise involving P. Diddy.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“to get into this hotel’s network, it started with a phishing e-mail”
P. Diddy hotel compromise INITIAL_ACCESS_VIA phishing
The hotel compromise began with a phishing email crafted to appear to come from another hotel employee.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“it started with a phishing e-mail”
P. Diddy hotel compromise INVOLVES Malware
The attached application in the phishing email was malware that gave TeaMp0isoN access to a hotel computer.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“the app was malware, so when the employee opened it, it gave TeaMp0isoN access to the computer in the hotel”
P. Diddy hotel compromise INVOLVES lateral movement
After gaining access, the attackers performed lateral movement to other machines on the hotel network.
Explicit Confidence 99% · MLT EP 109 Details
“we performed some lateral movement and gained access to some other machines on the network”
TeaMp0isoN TARGETS BlackBerry
TeaMp0isoN targeted BlackBerry because it cooperated with police during the London riots by providing BBM-user information.
Explicit Confidence 98% · MLT EP 109 Details
“As a result, TriCk decided to attack BlackBerry.”
TeaMp0isoN USES social engineering
TeaMp0isoN used telephone social engineering while impersonating Google employees.
Explicit Confidence 99% · MLT EP 109 Details
“We called them all up, pretending to be from Google”
TeaMp0isoN USES password reset attack
The attackers requested Gmail password resets and persuaded employees to disclose the received security codes.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“we’d just do a password reset request on their Gmail account”
TeaMp0isoN USES WordPress
After compromising employee Gmail accounts, the attackers used the WordPress password-reset process to access the BlackBerry blog.
Explicit Confidence 98% · Jack Rhysider EP 109 Details
“this BlackBerry blog was just a WordPress site”
Anti-Terrorist Hotline attack INVOLVES PBX
TriCk compromised a PBX server based in the Philippines as part of the Anti-Terrorist Hotline attack.
Explicit Confidence 99% · MLT EP 109 Details
“He compromised a PBX server that was based in the Philippines”
Anti-Terrorist Hotline attack INVOLVES Asterisk
Asterisk was used to script the repeated calls against the Anti-Terrorist Hotline.
Explicit Confidence 99% · MLT EP 109 Details
“he wrote a script using Asterisk”
Anti-Terrorist Hotline attack INVOLVES caller ID spoofing
The attack spoofed caller IDs in a loop and generated different caller IDs repeatedly.
Explicit Confidence 99% · MLT EP 109 Details
“spoofed caller IDs in a loop and randomly generated the caller IDs”
Anti-Terrorist Hotline attack INVOLVES DDoS
The Anti-Terrorist Hotline attack was a denial-of-service attack using repeated computer-generated calls.
Explicit Confidence 99% · MLT EP 109 Details
“it’s a denial-of-service against the anti-terror hotline”
Anti-Terrorist Hotline attack INVOLVES TeaMp0isoN
TeaMp0isoN was reported as having jammed the UK counter-terrorism hotline with computer-generated calls.
Attributed Confidence 96% · Host6 EP 109 Details
“TeaMp0isoN is an anarchist, hacktivist group, and it began by jamming the UK’s counter-terrorism hotline”
After moving to Syria, Junaid Hussain joined ISIS.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“Junaid Hussain had joined ISIS, a terrorist organization”
Sally Jones MEMBER_OF ISIS
Sally Jones went to Syria, reunited with Junaid, and was described as participating in ISIS activities.
Derived Confidence 88% · Jack Rhysider EP 109 Details
“Sally Jones decided to go to Syria, too”
Cyber Caliphate DEVELOPED_BY TriCk
Junaid Hussain started the Cyber Caliphate to conduct cyber attacks on behalf of ISIS.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 109 Details
“He started a new hacker group called the Cyber Caliphate”
Cyber Caliphate ASSOCIATED_WITH ISIS
The Cyber Caliphate was created to carry out cyber attacks on behalf of ISIS.
Explicit Confidence 98% · Jack Rhysider EP 109 Details
“to carry out cyber attacks on behalf of ISIS”
TriCk USES malicious APK
According to an uncertain rumor relayed by MLT, someone tricked Junaid into downloading a malicious APK to obtain his location.
Uncertain Confidence 76% · MLT EP 109 Details
“someone tricked him into downloading a malicious APK file onto his Android phone”
malicious APK AFFECTS Android
The alleged malicious APK was downloaded onto Junaid's Android phone.
Uncertain Confidence 86% · MLT EP 109 Details
“onto his Android phone”
Junaid Hussain drone-strike incident TARGETS TriCk
The later US drone strike targeted and killed Junaid Hussain in Syria.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“Junaid Hussain was killed on August 25, 2015”
MLT USES bug bounty hunting
MLT said he spent about five years doing bug bounty hunting.
Explicit Confidence 99% · MLT EP 109 Details
“I was doing a lot of bug bounty hunting”
MLT USES exploit development
MLT shifted from bug bounty hunting to zero-day exploit development and selling the resulting exploits.
Explicit Confidence 99% · MLT EP 109 Details
“I’ve kinda shifted my focus recently to zero-day exploit development”
MLT recently started the legally oriented hacking group 0xffff.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“MLT has taken his interest in all this and recently started a new hacking group called 0xffff”
MLT is the founder and an active member of the 0xffff hacking group.
Derived Confidence 90% · Jack Rhysider EP 109 Details
“recently started a new hacking group called 0xffff”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:26:38.216328+00:00