Episode
01 April 2018 Official episode · Official transcript
incident response
Incident responders investigate a global retail breach involving Tiny POS-derived malware on point-of-sale and back-of-house systems, encrypted output files, extensive backdoors, and stolen payment-card data.
Topics: Point-of-sale malware, Tiny POS-derived malware, Payment-card memory scraping, XOR-encrypted output files, Endpoint monitoring and analysis, Phishing as suspected initial access, Lateral movement across a flat network, Central pivot points and clearing-house systems, Backdoors and persistence, IP scanning, Historical card-data exposure in SQL server memory, Network segmentation, Incident response and digital forensics, Payment-card breach quantification and deduplication
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Retail credit-card breach INVOLVES Kroll
The retail company hired Kroll to investigate possible malware in its network.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“this store wanted to investigate anyways so they called a consulting firm called Kroll”
Courtney Dayter MEMBER_OF Kroll
Courtney was one of the Kroll incident-response team members working on the case.
Explicit Confidence 95% · Jack Rhysider EP 15 Details
“Let’s meet two of the members of that team.”
“My name’s Courtney Dayter. I’m a Senior Managing Consultant.”
Matt Bromiley MEMBER_OF Kroll
Matt was part of the Kroll incident-response team during the investigation.
Explicit Confidence 95% · Jack Rhysider EP 15 Details
“Let’s meet two of the members of that team.”
“My name is Matt Bromiley.”
Kroll USES Carbon Black
Kroll’s incident-response team primarily used Carbon Black for endpoint monitoring and analysis across the environment.
Explicit Confidence 99% · Matt Bromiley EP 15 Details
“The tool that we use primarily is Carbon Black which is an end-point monitoring tool”
Carbon Black AFFECTS Windows XP
Carbon Black was deployed broadly to systems running Windows XP and above that could support its agent.
Explicit Confidence 90% · Matt Bromiley EP 15 Details
“everything Windows XP and above”
Retail credit-card breach COMPROMISES Point-of-sale registers
The breach compromised cash-register systems used to process payment cards.
Explicit Confidence 99% · Matt Bromiley EP 15 Details
“the systems that are compromised are those particular systems”
“They’re the cash registers where you go buy something and you swipe your card”
Retail credit-card breach INVOLVES Tiny POS
The newly uncovered card-scraping malware was described as a derivative of the Tiny POS malware family.
Explicit Confidence 96% · Matt Bromiley EP 15 Details
“it’s an unknown variant but it’s a derivative of Tiny POS”
Tiny POS USES Memory scraping
The card-scraping malware scraped payment-card data from memory.
Explicit Confidence 99% · Courtney Dayter EP 15 Details
“The way that they were scraping cards were – they were scraping from memory.”
The malware’s output files were encrypted using XOR.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“The output files were encrypted using XOR”
Tiny POS AFFECTS Point-of-sale registers
The malware ran on point-of-sale registers and captured card data processed there.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“Malware that exists on twelve hundred computers that are cash registers”
“the malware was grabbing every credit card that was swiped on that register”
Tiny POS AFFECTS Back-of-house systems
The malware also ran on back-of-house systems and scraped data there.
Explicit Confidence 99% · Matt Bromiley EP 15 Details
“The other twenty percent was the back of house systems as well”
“Those systems were also – also had data that was being scraped in them, too.”
Tiny POS AFFECTS SQL servers
The malware captured historical unencrypted track data loaded into SQL-server memory.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“The back of house systems were running SQL servers.”
“The SQL servers had historical unencrypted tracked data that was being loaded into memory and the malware was picking that up.”
Tiny POS USES Data exfiltration
The malware pushed scraped data over the network to central repository or clearing-house systems.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“it pushes that data over the wire to the central repository system”
“Malware was directly writing over the wire right to these systems”
Retail credit-card breach INVOLVES lateral movement
After gaining network access, the attackers moved to other machines and propagated through the environment.
Explicit Confidence 98% · Jack Rhysider EP 15 Details
“When the hacker is in the network, they can move over to another machine to start setting up their malware.”
Retail credit-card breach INITIAL_ACCESS_VIA phishing
Matt personally believed the attackers probably entered through a phishing message, but he presented this as uncertain rather than confirmed.
Uncertain Confidence 86% · Matt Bromiley EP 15 Details
“I think personally, they came in with a phish”
“it makes me want to think it was likely a targeted approach but you never know”
Retail credit-card breach INVOLVES Backdoor
The attackers installed hundreds of back doors to preserve access to systems.
Explicit Confidence 99% · Courtney Dayter EP 15 Details
“They had added 350 back doors.”
“they were just allowing themselves access back in”
Retail credit-card breach INVOLVES IP scanner
During the attackers’ renewed activity, the team observed them running an IP scanner and logging into multiple IP addresses.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“they ran an IP scanner and then hard-coded and were able to log into all these IPs”
Retail credit-card breach INVOLVES Network segmentation
The company’s flat network and lack of segmentation enabled the malware to spread widely; network-infrastructure changes were recommended afterward.
Explicit Confidence 98% · Courtney Dayter EP 15 Details
“changing their network infrastructure so it’s not so flat”
“every system could essentially reach every other system”
Matt Bromiley MEMBER_OF Cylance
Matt later moved from Kroll to Cylance.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“Matt has since moved from Kroll and is now working at Cylance”
Jack Rhysider AUTHORED Darknet Diaries
Jack states that the show is made entirely by him.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“This show is made entirely by me, Jack Rhysider.”
passwordwolf.com DEVELOPED_BY Jack Rhysider
Jack says he made the password-generator website and its API.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“I made a random password generator.”
“It has an API which allows you to use it in your own programs.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T03:43:50.417366+00:00