Liam O’Murchu MEMBER_OF Symantec
Liam O’Murchu says he works with Symantec in its Security Response Department analyzing malware.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“I work with Symantec and I’ve been there since 2004”
Episode
02 June 2026 Official episode · Official transcript
cybercrime incident response botnet
The episode examines the Bayrob malware operation, its fraud against eBay users, extensive proxy and encryption infrastructure, and the long FBI investigation that led to the convictions of three Romanian operators.
Topics: Bayrob malware and eBay session manipulation, Botnet-based fraud and cryptocurrency mining, Multi-hop proxy chains and traffic anonymization, Stolen Wi-Fi and directional antennas, Encrypted Jabber communications and OTR, Unencrypted chat attachments as an operational-security failure, PGP email encryption, Layered disk encryption using LUKS, TrueCrypt, and custom encryption, Command-and-control infrastructure and data interception, Money-mule networks, Phishing and fraudulent online advertisements, Digital forensics and metadata correlation, International cybercrime investigations and MLATs, Wiretaps and data intercepts on servers
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Liam O’Murchu MEMBER_OF Symantec
Liam O’Murchu says he works with Symantec in its Security Response Department analyzing malware.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“I work with Symantec and I’ve been there since 2004”
Stacy Whittaker MEMBER_OF FBI
Stacy Whittaker identifies herself as a retired FBI agent and describes working as an FBI agent on the Bayrob investigation.
Explicit Confidence 99% · Stacy Whittaker EP 175 Details
“I am now a retired FBI agent”
Ryan Macfarlane MEMBER_OF FBI
Ryan Macfarlane says he was a cyber agent when he joined the Bayrob investigation.
Explicit Confidence 98% · Ryan Macfarlane EP 175 Details
“at the time I was a cyber agent”
Brian Levine MEMBER_OF Computer Crime and Intellectual Property Section
Brian Levine identifies himself as the cyber-crime prosecutor at CCIPS.
Explicit Confidence 99% · Brian Levine EP 175 Details
“I was the cyber-crime prosecutor at the Computer Crime and Intellectual Property Section”
Eoin Miller MEMBER_OF AOL
Eoin Miller says he worked on AOL’s CERT team.
Explicit Confidence 99% · Eoin Miller EP 175 Details
“I worked on AOL’s cert team from 2011 to 2016”
Bayrob DISCOVERED_BY Liam O’Murchu
Liam received and investigated the malware sample that became Bayrob, discovering how it worked and how the criminals used it.
Explicit Confidence 93% · Liam O’Murchu EP 175 Details
“I got this file that I wanted to analyze”
Bayrob ATTRIBUTED_TO Bayrob Group
The episode presents Bayrob as the malware operated by the Bayrob Group, while describing the group as the criminals behind the fraud.
Explicit Confidence 94% · Jack Rhysider EP 175 Details
“the Bayrob malware campaign”
Bayrob campaign INVOLVES Bayrob
The Bayrob campaign involved the Bayrob malware.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“the Bayrob malware campaign”
Bayrob targeted eBay customers by intercepting visits to the eBay website and presenting fraudulent auctions.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“they were trying to defraud customers of eBay”
Bayrob USES browser session injection
Bayrob intercepted eBay connections and injected false information into the victim’s browsing session.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“it would intercept your connection and it would inject false information into your browsing session”
The malware was distributed through phishing emails and Craigslist posts.
Explicit Confidence 98% · Jack Rhysider EP 175 Details
“specifically through phishing e-mails and Craigslist posts”
Bayrob USES geofencing
The attackers geofenced the fraud so it would operate only in America and selected locations within the United States.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“the attackers were geofencing their fraud so that it could only happen in America”
Bayrob USES Money mule
Bayrob’s operators used money mules to receive victims’ payments and forward the money through additional intermediaries.
Explicit Confidence 97% · Jack Rhysider EP 175 Details
“the criminals hired someone else to collect that money, keep a portion of it, and then forward the rest”
Bayrob Group USES proxy chain
The Bayrob Group routed traffic through multiple infected machines and used those machines as proxy-chain hops to conceal its origin.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“they would jump through multiple infected machines in multiple countries”
Bayrob Group USES Tor
The Bayrob Group used Tor as part of its layered routing and concealment infrastructure.
Explicit Confidence 99% · Brian Levine EP 175 Details
“they would go to Tor, then from Tor they would go through their proxy chain”
Bayrob Group USES Jabber
The attackers used Jabber to communicate with one another.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“I could tell these guys were talking over Jabber”
Bayrob Group USES Off The Record
The attackers used Off The Record encryption for their Jabber chats.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“they were using OTR, Off The Record, which does end-to-end encryption on all Jabber chats”
Bayrob USES command-and-control infrastructure
Bayrob communicated with and used a multi-layer command-and-control infrastructure.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they had a multi-layer command-and-control infrastructure”
Bayrob USES cryptocurrency mining
The malware-controlled systems were instructed to join mining pools and mine cryptocurrency for the group.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“We saw them instructing these computers to join mining pools and mine cryptocurrency for them”
Bayrob Group USES AlphaBay
The Bayrob Group sold proxies and stolen credit-card information on AlphaBay.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“some of those proxies were sold on AlphaBay”
“which they then sold on AlphaBay as well”
Bayrob EXPLOITS unencrypted Jabber attachments
The operators’ use of Jabber exposed unencrypted attachments, allowing investigators to extract spreadsheets and screenshots from the network traffic.
Explicit Confidence 94% · Jack Rhysider EP 175 Details
“attachments are not — it doesn’t default to encryption”
AOL built and deployed a packet-capture indexing system called Moloch at the ISP level.
Explicit Confidence 98% · Eoin Miller EP 175 Details
“we built a full packet-capture indexing system — at the time it was called Moloch”
Bayrob Group USES directional Wi-Fi antenna
The group used directional Wi-Fi antennas to connect to and steal neighboring Wi-Fi networks, helping conceal its actual locations.
Explicit Confidence 99% · Brian Levine EP 175 Details
“They would hack into another account in Bucharest”
“these large directional antennas”
Bayrob Group USES custom flashed router
Each member received a custom-flashed router that allowed the group to proxy traffic between different houses.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“each of them got a custom flashed router”
Bayrob Group USES LUKS
The group used LUKS to encrypt its Linux systems.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they were running Linux with LUKS on it”
Bayrob Group USES TrueCrypt
The group used multiple TrueCrypt containers to protect its work systems.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they had a couple of TrueCrypt containers on it”
Bogden Nicolescu MEMBER_OF Bayrob Group
Bogden Nicolescu, also called Masterfraud, is identified as one of the three main people behind the Bayrob campaign and as the group’s leader.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“There was Bogden Nicolescu, AKA Masterfraud”
“the head of the group”
Tiberiu Danet MEMBER_OF Bayrob Group
Tiberiu Danet, also called Amightysa, is identified as one of the three main people behind the Bayrob campaign.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“Tiberiu Danet, AKA Amightysa”
Radu Miclaus MEMBER_OF Bayrob Group
Radu Miclaus, also called Minolta and Raduspr, is identified as one of the three main people behind the Bayrob campaign.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“Radu Miclaus, AKA Minolta, AKA Raduspr”
TrueCrypt DEVELOPED_BY Bogden Nicolescu
No claim is made that Nicolescu developed TrueCrypt; rather, the episode says he wrote a separate encryption software layer. This claim is omitted because no catalog entity exists for that custom software.
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T09:01:22.307963+00:00