Jack Rhysider AUTHORED Darknet Diaries
Jack Rhysider says he created this episode of Darknet Diaries.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“This episode was created by me, Mr. Glitchy Pants, Jack Rhysider.”
Episode
04 August 2026 Official episode · Official transcript
cybercrime incident response
The episode describes the Ubiquiti cloud breach and extortion scheme carried out by employee Nickolas Sharp, including unauthorized access to AWS and GitHub, theft of private repositories, deletion and manipulation of logs, and subsequent investigation and prosecution.
Topics: Cloud infrastructure security, AWS identity and access management, Excessive privileges and least privilege, GitHub repository security, Source-code and secret exfiltration, VPN use and IP-address attribution, VPN kill switches, SSH access, Credential and password-vault security, Log retention and log deletion, Incident response and digital forensics, MAC-layer and IP-layer network evidence, Ransomware and ransom negotiation, Bug bounty programs, Insider threat and unauthorized access, Data extortion
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Jack Rhysider AUTHORED Darknet Diaries
Jack Rhysider says he created this episode of Darknet Diaries.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“This episode was created by me, Mr. Glitchy Pants, Jack Rhysider.”
Laura Woods AUTHORED Darknet Diaries
Laura Woods is credited with researching and writing the episode.
Explicit Confidence 96% · Jack Rhysider EP 178 Details
“This episode was researched and written by Clippy’s revenge, Laura Woods.”
Nickolas Sharp MEMBER_OF Ubiquiti
Nickolas Sharp worked for Ubiquiti and eventually led its cloud team.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“he quit his job at AWS and took the job at Ubiquiti”
“ended up leading the whole cloud team”
Robert Pera MEMBER_OF Ubiquiti
Robert Pera is identified as Ubiquiti’s CEO and Nick’s boss.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“His big boss was Robert Pera, the CEO of Ubiquiti.”
Ubiquiti breach COMPROMISES Ubiquiti
The breach involved unauthorized access to Ubiquiti systems and theft of company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Somebody has been poking around where they shouldn’t have, and data has been exfiltrated”
Ubiquiti breach INVOLVES Nickolas Sharp
The episode presents Nickolas Sharp as the insider responsible for carrying out the Ubiquiti breach; he later admitted the plan.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“In February 2023 he pleads guilty to three counts”
“Nick admits that it was all planned for financial gain.”
Nickolas Sharp USES Amazon Web Services
Nick used his normal Ubiquiti credentials to log into the company’s AWS cloud environment.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick fires up his work laptop. He logs into Ubiquiti’s cloud environment on AWS.”
Nickolas Sharp USES GitHub
Nick used Ubiquiti’s GitHub account and repositories to access and clone private source-code data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick logs into Ubiquiti’s GitHub account.”
“he starts running commands to clone these top-secret files”
Nickolas Sharp USES Surfshark VPN
Nick purchased and used Surfshark VPN to conceal his IP address during the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick went with Surfshark VPN.”
“Nick was connected behind that Surfshark VPN”
Nickolas Sharp USES VPN
Nick used a VPN to hide his IP address while accessing Ubiquiti systems.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“He got a twenty-seven-month subscription”
“His IP is hidden”
Nickolas Sharp USES VPN kill switch
Nick enabled a VPN kill switch to prevent connections from going out if the VPN disconnected.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He thought about that and enabled a VPN kill switch”
Nickolas Sharp USES SSH
Nick connected to GitHub via SSH while using the shared high-level account.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He connects via SSH.”
Nickolas Sharp USES get-caller-identity
Nick ran get-caller-identity to verify the identity of the account he was using.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick then runs a command called get-caller-identity.”
Nickolas Sharp USES Keybase
Nick used Keybase to communicate with a senior Ubiquiti employee and publish stolen data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick himself was active on Keybase”
“Nick uploads the stolen data to a public Keybase folder.”
Nickolas Sharp USES Data exfiltration
Nick downloaded more than 100 repositories containing gigabytes of confidential company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“he’s cloned and downloaded over 100 repositories”
“That’s gigabytes of confidential company data.”
Nickolas Sharp USES log deletion
Nick changed AWS log-retention policies to one day in an attempt to delete evidence of his activity.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He changes the life cycle retention policies to just one day.”
“This will delete the logs”
Nickolas Sharp USES principle of least privilege
Nick had advocated the principle of least privilege, although he also exploited Ubiquiti’s overly broad access controls.
Explicit Confidence 97% · Jack Rhysider EP 178 Details
“The principle of least privilege is something he tried to tell them about”
Ubiquiti USES Amazon Web Services
Ubiquiti hosted its cloud environment and systems on AWS.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“Ubiquiti’s cloud environment on AWS”
Ubiquiti used GitHub to store source code and private repositories.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“GitHub is where Ubiquiti stores their source code.”
Ubiquiti’s bug-bounty program was run through HackerOne.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“This program, run by HackerOne, rewards people for finding vulnerabilities.”
Ubiquiti used Keybase as a channel through which the attacker contacted a senior employee and uploaded data.
Explicit Confidence 95% · Jack Rhysider EP 178 Details
“They contact Keybase”
“Keybase removes all the data that Nick uploaded.”
CWT ransomware attack COMPROMISES Carlson Wagonlit Travel Company
The CWT ransomware attack compromised Carlson Wagonlit Travel Company’s network and rendered many computers unusable.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Then they infected the network with ransomware.”
“Ransomware rendered a lot of their computers worthless”
CWT ransomware attack INVOLVES Ransomware
The CWT attack involved ransomware.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Then they infected the network with ransomware.”
CWT ransomware attack INVOLVES Data exfiltration
The attackers stole two terabytes of data from CWT.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“The hackers stole two terabytes of data.”
Garmin ransomware attack INVOLVES Ransomware
The Garmin attack involved ransomware.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Garmin, the GPS company, gets hit with ransomware, too”
Garmin ransomware attack ATTRIBUTED_TO Evil Corp
The Garmin ransomware attack is attributed in the episode to Evil Corp.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“this time by a hacker group called Evil Corp”
Ubiquiti breach INVOLVES Data exfiltration
The Ubiquiti breach involved exfiltration of private repositories and other confidential company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“data has been exfiltrated”
“he’s cloned and downloaded over 100 repositories”
Ubiquiti breach INVOLVES log deletion
The breach involved Nick’s deletion or attempted deletion of AWS logs to conceal activity.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“This will delete the logs”
Ubiquiti breach INVOLVES MacBook
Forensics linked a MacBook connected to Nick’s router with the large data transfer during the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“a MacBook laptop was used to connect to the router”
Ubiquiti breach INVOLVES MAC address
Investigators used MAC-address information from the home router to identify the device involved in the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“they can see which MAC address connected to that Ubiquiti router”
Ubiquiti breach INVOLVES IP address
The investigation involved matching Nick’s home IP address with the IP address used in the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“His home IP address was found in the investigation”
“the IPs match”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T09:06:02.921357+00:00