Adam Georgeson MEMBER_OF The Academy
Adam worked as an IT apprentice and technician at The Academy before being dismissed.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“The job was to do IT work at the Academy.”
Episode
21 March 2022 Official episode · Official transcript
cybercrime black hat
Adam Georgeson describes exploiting retained administrative access to a former school and later employer, moving through their networks, wiping infrastructure and connected devices, and subsequently being arrested and sentenced.
Topics: Cloud identity and administration through Office 365, Active Directory and domain controllers, Privileged access management and least privilege, Password reuse, password guessing and credential rotation, VPN remote access, Remote Desktop Protocol and internal network traversal, Lateral movement, Saved administrative credentials, IP and network scanning, Remote mobile-device wiping, Destructive server and backup deletion, Virtual-machine hosts and hypervisors, Logging, attribution and incident investigation, Recovery from loss of infrastructure and backups
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Adam Georgeson MEMBER_OF The Academy
Adam worked as an IT apprentice and technician at The Academy before being dismissed.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“The job was to do IT work at the Academy.”
The Academy USES Office 365
The Academy used Office 365 to manage its network, users, and email.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“This is the tool the Academy used to manage the school’s network, like usernames and e-mail boxes and that sort of thing.”
The Academy USES Active Directory
The Academy used Active Directory as part of its network administration.
Explicit Confidence 96% · Jack Rhysider EP 113 Details
“look at and configure the Active Directory settings”
The Academy USES SharePoint
The Academy used SharePoint, which later became unavailable during the attack.
Explicit Confidence 98% · Jack Rhysider EP 113 Details
“SharePoint was down, e-mails were down”
The Academy USES Skype
Skype was configured through the Academy’s Office 365 environment.
Explicit Confidence 94% · Jack Rhysider EP 113 Details
“configure Skype, see SharePoint sites”
The Academy USES Microsoft Teams
Microsoft Teams was used for messaging at the Academy.
Explicit Confidence 88% · Jack Rhysider EP 113 Details
“read messages on Teams and Slack without people knowing”
Adam Georgeson EXPLOITS shared local administrator password
Adam exploited the Academy’s use of the same local administrator password on all student computers.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“it was the same one at every single computer in the school”
Adam Georgeson EXPLOITS weak and reused administrative passwords
Adam exploited weak, reused, and patterned administrative passwords, including the domain administrator password.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“he guessed what the domain admin password was”
Adam Georgeson USES Office 365
Adam used the Academy’s Office 365 administrator portal to access accounts and administrative functions.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“I was logged into the school’s admin portal on Office 365.”
Adam Georgeson USES VPN
Adam used the Academy’s VPN to connect to its internal network from home.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“I successfully VPNs into the school’s network”
Adam Georgeson USES password guessing
Adam guessed Office 365 and VPN passwords by following the Academy’s password patterns.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“After a few hours at guessing VPN passwords, he finally gets it.”
Adam Georgeson USES privilege escalation
Adam escalated from a lower-level Office 365 account to an account with super-administrator rights.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He’s done what’s called privilege escalation.”
Adam Georgeson USES credentialed remote access
Adam used saved credentials and Remote Desktop connections to access additional computers and servers.
Explicit Confidence 98% · Adam Georgeson EP 113 Details
“there was sort of saved credentials”
Adam Georgeson USES IP scanning
Adam used an IP scanner to enumerate computers on the Academy’s network.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“uses an IP scanner to get a lay of the land”
Adam Georgeson USES lateral movement
Adam moved from one computer to another across the Academy’s network to reach infrastructure systems.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam kept hopping from one system to another”
Academy network attack COMPROMISES The Academy
The attack compromised and destroyed The Academy’s network infrastructure.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam had obliterated the Academy’s whole infrastructure”
Academy network attack INITIAL_ACCESS_VIA Office 365
The attack initially gained access through the Academy’s Office 365 administrator account.
Derived Confidence 96% · Jack Rhysider EP 113 Details
“He was logged into the school’s admin portal on Office 365.”
Academy network attack INVOLVES VPN
The attack involved gaining VPN access to the Academy’s internal network.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He successfully VPNs into the school’s network”
Academy network attack INVOLVES lateral movement
The attack involved lateral movement across multiple Academy systems and servers.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“What he’s doing is a classic example of lateral movement”
Academy network attack INVOLVES mobile device wipe
The attack included an attempt to wipe 2,947 mobile devices connected to the Academy’s Office 365 environment.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam had just attempted to wipe 2,947 devices”
Academy network attack INVOLVES destructive data wiping
The attack involved wiping servers, domain controllers, backups, and other infrastructure.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“the process of wiping the entire servers that I was on”
Academy network attack INVOLVES Domain controller
The attack involved running a destructive wipe command against a domain controller.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“I ran that on I think the domain controller.”
Academy network attack INVOLVES backup server
The attack involved wiping the Academy’s backup and secondary backup servers.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“There was a backup server and a secondary backup server”
Academy network attack INVOLVES hypervisor
The attack reached a hypervisor hosting the network’s backups, which were then wiped.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“it was a hypervisor, basically”
Academy network attack INVOLVES log and evidence evasion
Adam attempted to cover his tracks by deleting logs and other evidence, although he could not access the firewall logs.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“let’s try and get rid of as much as possible to try and cover my tracks”
Unnamed IT company network attack INVOLVES Office 365
The later attack against Adam’s employer involved logging into the company’s Office 365 portal and reaching its global administrator account.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He uses the domain admin credentials that he still had written down somewhere to log into this company’s Office 365 portal.”
Unnamed IT company network attack INVOLVES privilege escalation
The later attack involved moving from the Office 365 portal to the global administrator account.
Explicit Confidence 98% · Jack Rhysider EP 113 Details
“From there, he gets access to the global administrator account”
Unnamed IT company network attack INVOLVES credentialed remote access
The later attack used retained domain administrator credentials to access the employer’s network services.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He uses the domain admin credentials that he still had written down”
Unnamed IT company network attack INVOLVES log and evidence evasion
The later attack included uninstalling software and changing administrator passwords, actions that disrupted systems and limited access.
Explicit Confidence 96% · Jack Rhysider EP 113 Details
“he changed their passwords so they couldn’t log in anymore”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:31:39.048398+00:00