Episode

EP 20 — mobman

15 August 2018 Official episode · Official transcript

cybercrime black hat

The episode features Mobman discussing Sub7, unauthorized access to AT&T systems, the resulting telephone-network outage, and the disputed attribution of Sub7’s creation.

Topics: Remote-access Trojans, Credential theft from clear-text configuration files, Social engineering and game-cheat lures, Malware binding to legitimate executables, Wardialing and dial-up PBX access, Firmware modification and network outages, Accessibility-feature abuse for command-prompt access, Webcam surveillance by malware, Historical attribution of Sub7

Official episode-page sources

Links published on the Darknet Diaries episode page. Not LLM output.

No Sources heading on this episode page.

Entities (29)

Claims (23)

Qualified statements from this episode, not graph facts.

Darknet Diaries DEVELOPED_BY Jack Rhysider

Jack says the show is made entirely by him.

Explicit Confidence 99% · Jack Rhysider EP 20 Details

“This show is made entirely by me, Jack Rhysider”

Jack Rhysider · offsets 41317–41364

Mobman USES Ultima Online

Mobman played Ultima Online extensively and used it as the setting for his in-game exploits.

Explicit Confidence 99% · Mobman EP 20 Details

“I started playing a game called Ultima Online”

Mobman · offsets 1783–1828

clear-text credential storage AFFECTS Ultima Online

Ultima Online's saved-login feature stored usernames and passwords in a clear-text file.

Explicit Confidence 98% · Jack Rhysider EP 20 Details

“it actually saves your username and password in a clear text file called uo.cfg”

Jack Rhysider · offsets 5410–5489

Mobman EXPLOITS clear-text credential storage

Mobman obtained players' uo.cfg files to log into their Ultima Online accounts.

Explicit Confidence 99% · Mobman EP 20 Details

“if we get other people’s uo.config file, ‘cause there’s some idiots at school that play it, we could log in as them”

Mobman · offsets 5546–5661

Sub7 DEVELOPED_BY Mobman

Mobman claims he created Sub7, and Jack presents him as its maker, but the episode later reports competing claims that another person created it.

Uncertain Confidence 72% · Jack Rhysider EP 20 Details

“Mobman called his virus Sub7”

Jack Rhysider · offsets 6585–6613

“Mobman stands firm on his claim that he wrote Sub7 but Ill Will says it wasn’t him”

Jack Rhysider · offsets 39520–39602

Mobman USES Sub7

Mobman used Sub7 to steal Ultima Online credentials and in-game property.

Explicit Confidence 99% · Jack Rhysider EP 20 Details

“Mobman only used Sub7 to steal Ultima Online logins for himself”

Jack Rhysider · offsets 13834–13897

Sub7 USES ICQ

Sub7 sent infected users' IP addresses and online status to Mobman through ICQ.

Explicit Confidence 98% · Mobman EP 20 Details

“When they get infected with it, it’ll send you an ICQ message and it’ll tell you their IP address and that they’re online”

Mobman · offsets 6456–6577

Sub7 AFFECTS Ultima Online

Sub7 was used to obtain and abuse Ultima Online account credentials.

Explicit Confidence 97% · Jack Rhysider EP 20 Details

“created to steal Ultima Online log ins”

Jack Rhysider · offsets 12044–12082

Mobman USES social engineering

Mobman socially engineered players into installing Sub7 by offering it as a game cheat.

Explicit Confidence 99% · Jack Rhysider EP 20 Details

“He was able to social engineer dozens of players to install the virus”

Jack Rhysider · offsets 10592–10661

Sub7 USES malware binding to an executable

Sub7 could be melded with a normal executable so that the executable still appeared to work while infecting the user.

Explicit Confidence 99% · Mobman EP 20 Details

“you click Meld and it’ll meld the malware with the executable”

Mobman · offsets 12994–13055

Sub7 ASSOCIATED_WITH remote-access tool

Mobman describes Sub7 as a remote-access tool and Trojan horse virus.

Explicit Confidence 98% · Mobman EP 20 Details

“It’s a remote-access tool. It was a Trojan horse virus”

Mobman · offsets 5979–6034

Mobman USES wardialing

Mobman used wardialing to identify modem-connected systems in AT&T's network.

Explicit Confidence 99% · Jack Rhysider EP 20 Details

“This is called wardialing”

Jack Rhysider · offsets 17260–17285

Mobman COMPROMISES PBX

Mobman gained access to AT&T systems and says he bricked a central switching PBX.

Explicit Confidence 93% · Mobman EP 20 Details

“I get into a couple of them”

Mobman · offsets 17497–17524

“bricked one of these central switching PBXs”

Mobman · offsets 19796–19839

AT&T west coast network outage INVOLVES AT&T

The outage affected AT&T's network in California, Nevada, and the wider west coast area.

Explicit Confidence 98% · Mobman EP 20 Details

“we just have a big network outage over there”

Mobman · offsets 19570–19614

AT&T west coast network outage INVOLVES PBX

The outage involved a central switching PBX that Mobman says was bricked.

Explicit Confidence 96% · Mobman EP 20 Details

“one of these central switching PBXs which happened to run like, the whole west coast telephone systems”

Mobman · offsets 19804–19906

AT&T west coast network outage INVOLVES firmware rewriting

Mobman says the commands rewrote the firmware and caused the PBX to become unusable.

Explicit Confidence 98% · Mobman EP 20 Details

“Apparently it rewrote the firmware on it and bricked one of these central switching PBXs”

Mobman · offsets 19751–19839

AT&T west coast network outage ATTRIBUTED_TO Mobman

Mobman admits that his commands caused the outage, although the account is his own recollection.

Explicit Confidence 90% · Mobman EP 20 Details

“I’ll tell you why, if you fix my phone bill”

Mobman · offsets 28510–28554

“I bragged to them; I sit there and I tell them what I did”

Mobman · offsets 20035–20092

Magnifying Glass accessibility abuse USES cmd.exe

Mobman replaced magnify.exe with cmd.exe to obtain a command prompt at the login screen.

Explicit Confidence 99% · Mobman EP 20 Details

“I deleted Magnify and renamed cmd.exe to magnify”

Mobman · offsets 25962–26010

McAfee DEVELOPED_BY John McAfee

Jack says John McAfee started the McAfee antivirus software company.

Explicit Confidence 90% · Jack Rhysider EP 20 Details

“That’s John McAfee who started the McAfee antivirus software”

Jack Rhysider · offsets 34233–34293

Ill Will AUTHORED article by Ill Will

Jack identifies Ill Will as the author of the article disputing Mobman's account.

Explicit Confidence 99% · Jack Rhysider EP 20 Details

“The article is written by a guy named Ill Will”

Jack Rhysider · offsets 39013–39059

article by Ill Will MENTIONS Sub7

The article discusses who created Sub7 and disputes Mobman's claim of authorship.

Explicit Confidence 98% · Jack Rhysider EP 20 Details

“this article is saying otherwise”

Jack Rhysider · offsets 38978–39010

“Ill Will swears that this isn’t the guy who wrote it”

Jack Rhysider · offsets 40469–40521

Rolling Stone MENTIONS Sub7

Jack says Rolling Stone featured Mobman and stated that he created Sub7.

Attributed Confidence 90% · Jack Rhysider EP 20 Details

“Mobman was also featured in Rolling Stone magazine which says he did create it”

Jack Rhysider · offsets 38847–38925

Sub7 ASSOCIATED_WITH DEF CON

Mobman attended DEF CON and says people there recognized him for Sub7; this is an association rather than proof of authorship.

Explicit Confidence 88% · Mobman EP 20 Details

“I’ll go to Defcon or whatnot and people come up to me; they’re like oh man, you’re Sub7”

Mobman · offsets 36028–36115

Transcript references

Works mentioned in the transcript. Distinct from show-note sources.

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T04:16:16.868641+00:00