Default says he eventually took over AnonSec.
Explicit Confidence 98% · Default EP 139 Details
“I eventually ended up taking over the group”
Episode
07 November 2023 Official episode · Official transcript
cybercrime black hat hacktivism social engineering
The episode features Default describing his progression from gaming and IRC hacking into Anonymous-associated groups, politically motivated attacks, botnet-enabled intrusions, social-engineering attacks against US officials, prosecution, imprisonment, and recovery.
Topics: IRC-based hacker communities and trust problems caused by infiltration, Anonymous and the formation of affiliated and rival hacking groups, Denial-of-service traffic flooding using LOIC and Tor's Hammer, Botnets used to proxy attacks through compromised computers, Compromise of exposed administrative panels and default SSH credentials, Credential-reset abuse and brute forcing of four-digit recovery codes, Telephone-based social engineering of Verizon, AOL, and Comcast support, Account takeover and access to sensitive personal data, Doxxing and public disclosure of government and law-enforcement data, Access to LEEP and JABS databases, Tor, VPNs, public Wi-Fi, and operational security, Encrypted hard drives and evidence preservation, Bitcoin mining, wallets, and cryptocurrency seizure risk
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Default says he eventually took over AnonSec.
Explicit Confidence 98% · Default EP 139 Details
“I eventually ended up taking over the group”
Default says he joined AnonGhost before leaving because some leaders became radicalized.
Explicit Confidence 98% · Default EP 139 Details
“I joined into a group called AnonGhost”
Default says he joined AnonSec after leaving AnonGhost.
Explicit Confidence 98% · Default EP 139 Details
“Then I joined a group called AnonSec”
Default ASSOCIATED_WITH Team Poison
Default says he learned from Team Poison while becoming associated with other hacking groups.
Explicit Confidence 96% · Default EP 139 Details
“I started learning from Team Poison”
AnonSec ASSOCIATED_WITH Anonymous
AnonSec was associated with Anonymous by name, although Default says it was anti-Anonymous and disliked receiving attribution as Anonymous.
Explicit Confidence 94% · Default EP 139 Details
“it got associated with Anonymous so much”
Operation Detroit INVOLVES LOIC
The Detroit operation involved using LOIC to flood the water-payment-system target with traffic.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“Someone in the channel suggested they hit the site with LOIC”
Operation Detroit INVOLVES Tor's Hammer
The Detroit operation involved using Tor’s Hammer as an alternative traffic-flooding tool.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“Let’s use Tor’s Hammer”
LOIC USES Denial-of-service flooding
Jack describes LOIC as flooding the target with traffic until it cannot handle legitimate customers.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“it floods the target IP with loads of traffic”
Tor's Hammer USES Tor
Jack says Tor’s Hammer routes the attack traffic through Tor to hide its source.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“it uses Tor to route all the traffic through it”
Tor's Hammer USES Denial-of-service flooding
Tor’s Hammer was described as flooding the target with traffic and taking the payment system offline.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“this also floods the target with a whole bunch of traffic”
Operation Detroit INVOLVES Denial-of-service flooding
The operation used traffic flooding against Detroit’s water-payment system, which went offline.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“together launched an attack on Detroit’s water payment system, and immediately it went offline”
Default USES Denial-of-service flooding
Default identifies the Detroit attack as the beginning of his politically motivated activity, while the episode describes his participation in the flooding attack.
Derived Confidence 85% · Default EP 139 Details
“that was our first segue into politically-motivated stuff”
Operation Denmark INVOLVES Doxxing
Operation Denmark included publicly exposing information about the Danish government’s alleged tolerance of bestiality.
Derived Confidence 86% · Default EP 139 Details
“we actually defaced it and said, did you know that your government allows bestiality”
AnonSec built a botnet to route its attacks through compromised computers rather than directly from members.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“they decided they needed to build a botnet”
The group routed attack connections through Tor and its botnet for operational concealment.
Derived Confidence 91% · Jack Rhysider EP 139 Details
“they set up this botnet to pipe their traffic through someone else’s computer”
Default says he connected through his botnet when conducting activity online.
Explicit Confidence 99% · Default EP 139 Details
“I’m connecting through Tor nodes and my botnet”
Default says he connected through Tor nodes as part of his operational security.
Explicit Confidence 99% · Default EP 139 Details
“I’m connecting through Tor nodes”
Default USES Facebook four-digit PIN reset exploit
Default says he and the group used the Facebook four-digit PIN reset flaw to access accounts.
Explicit Confidence 96% · Default EP 139 Details
“I didn’t care if it was Facebook or Twitter, which we had a zero-day on”
Facebook four-digit PIN reset exploit AFFECTS Facebook
Jack explains that repeatedly submitting four-digit codes allowed attackers to reset Facebook passwords.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“they could just keep submitting codes to Facebook over and over”
Default MEMBER_OF Crackas With Attitude
Default joined Crackas With Attitude’s hacktivist activity and worked with Cracka against government targets.
Derived Confidence 91% · Jack Rhysider EP 139 Details
“he starts hanging out with these folks from CWA and joins in on their hacktivism”
Cracka MEMBER_OF Crackas With Attitude
Cracka is identified as the head of Crackas With Attitude.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“the head of CWA was a guy named Cracka”
Crackas With Attitude USES social engineering
CWA’s attacks against government personnel primarily used social engineering and information obtained through it.
Explicit Confidence 99% · Default EP 139 Details
“Most of it was just social engineering”
Crackas With Attitude USES Doxxing
CWA obtained and publicly exposed personal information belonging to government officials and police officers.
Explicit Confidence 98% · Default EP 139 Details
“we’re going to show the world this”
“we dropped their dox, pretty much”
John Brennan account compromise INVOLVES John Brennan
The incident involved unauthorized access to John Brennan’s personal AOL email account.
Explicit Confidence 99% · Pete Williams EP 139 Details
“he hacked his way into Brennan’s personal AOL e-mail account”
John Brennan account compromise INVOLVES Crackas With Attitude
The episode attributes the Brennan account compromise to the CWA hackers, including Default and Cracka.
Attributed Confidence 91% · Jack Rhysider EP 139 Details
“They were gonna call up Verizon, pose as a technician”
“Default and Cracka had it all”
John Brennan account compromise CONTAINS SF-86
The compromised email account contained John Brennan’s SF-86 form.
Explicit Confidence 99% · Default EP 139 Details
“he also had his SF-86 form in there”
Miami Dade Police data disclosure INVOLVES Doxxing
The Miami Dade disclosure consisted of publishing a list of police officers’ personal contact information.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“a list of eighty Miami police officers; their name, title, phone number, and e-mail address”
Crackas With Attitude USES Law Enforcement Enterprise Portal
CWA accessed LEEP and downloaded personal information about FBI agents.
Explicit Confidence 99% · Jack Rhysider EP 139 Details
“Default and Cracka got into the LEEP database and downloaded all the information”
Crackas With Attitude USES Joint Agency Booking System
CWA accessed JABS to look up people in the prison system and investigate other hackers.
Explicit Confidence 94% · Default EP 139 Details
“JABS, the Joint Agency Booking System”
Default recorded videos of his own criminal activity using Bandicam, according to the episode’s account of evidence seized from his computer.
Derived Confidence 86% · Jack Rhysider EP 139 Details
“Screenshots that you had taken, Bandicam videos”
Default says he mined and bought Bitcoin beginning in 2011 and held a substantial amount of it.
Explicit Confidence 99% · Default EP 139 Details
“Literally mining and buying from — since 2011”
Default believes the NSA may have been involved in hacking his computer and his eventual capture; he presents this as a theory rather than a confirmed fact.
Uncertain Confidence 88% · Default EP 139 Details
“I’m pretty sure that’s how I got caught, is that the NSA got involved”
Default ASSOCIATED_WITH Five Eyes
Default says the NSA and Five Eyes were becoming more aggressive with spying and hacking, presenting this as his view.
Uncertain Confidence 86% · Default EP 139 Details
“the NSA and the Five Eyes and all these other people that are occluding together are not being complacent. They’re actually getting more aggressive with the spying and the hacking”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:02:48.681241+00:00