Episode

EP 21 — Black Duck Eggs

01 September 2018 Official episode · Official transcript

penetration test social engineering

The episode features Ira Winkler and his former intelligence and Special Forces team conducting espionage simulations, penetration tests, social engineering, and physical intrusions against a major company's research and development facilities.

Topics: Social engineering and human elicitation, Penetration testing and espionage simulations, Physical intrusion and physical security weaknesses, Cryptanalysis and encryption, VPN access and preconfigured endpoint compromise, Privileged access to logged-on administrator systems, .rhost trusted-host configuration, Counterintelligence and detection of suspected foreign intelligence operations, Protection of research and development data and trade secrets

Official episode-page sources

Links published on the Darknet Diaries episode page. Not LLM output.

No Sources heading on this episode page.

Entities (25)

Claims (21)

Qualified statements from this episode, not graph facts.

Ira Winkler MEMBER_OF National Signals Intelligence Operations Center

Ira says he took a job as an Intelligence Analyst for the National Signals Intelligence Operations Center.

Explicit Confidence 99% · Ira Winkler EP 21 Details

“Finally I took a job as an Intelligence Analyst for the National Signals Intelligence Operations Center”

Ira Winkler · offsets 2759–2862

National Signals Intelligence Operations Center PART_OF National Security Agency

The National Signals Intelligence Operations Center is described as being within the NSA.

Explicit Confidence 94% · Ira Winkler EP 21 Details

“which was the only room that actually looks cool in NSA”

Ira Winkler · offsets 2888–2943

Ira Winkler USES cryptanalysis

Ira worked on cryptanalysis and programmed supercomputers to perform it.

Explicit Confidence 98% · Ira Winkler EP 21 Details

“My first technical computer job was programming super computers to do cryptanalysis”

Ira Winkler · offsets 3329–3412

Ira Winkler USES social engineering

Ira conducted a contract engagement using social engineering against an investment bank.

Explicit Confidence 99% · Jack Rhysider EP 21 Details

“the contract was to use social engineering against an investment bank”

Jack Rhysider · offsets 4600–4669

Ira Winkler USES human elicitation

Ira says he used basic human elicitation techniques to obtain information from people over the phone.

Explicit Confidence 99% · Ira Winkler EP 21 Details

“I just used essentially basic human elicitation techniques to lie to people over the phone”

Ira Winkler · offsets 4983–5073

Ira Winkler USES VPN

Ira obtained a computer preconfigured for the investment bank's VPN as part of the engagement.

Explicit Confidence 90% · Ira Winkler EP 21 Details

“I even got the investment bank to send me a computer preconfigured for their VPN”

Ira Winkler · offsets 5762–5842

Ira Winkler USES penetration testing

Ira's career is described as social engineering and penetration testing, including testing unauthorized access to places and information.

Explicit Confidence 99% · Jack Rhysider EP 21 Details

“That’s how Ira’s career got started as a social engineer and penetration tester”

Jack Rhysider · offsets 6596–6675

Ira Winkler USES espionage simulation

Ira says he specializes in assembling teams to conduct espionage simulations against organizations.

Explicit Confidence 98% · Ira Winkler EP 21 Details

“I like to call them more espionage simulations”

Ira Winkler · offsets 7872–7918

Ira Winkler USES physical intrusion

Ira used a team to enter secure buildings and conduct physical intrusions as part of penetration-testing missions.

Derived Confidence 90% · Jack Rhysider EP 21 Details

“using his crew to get into some of the most secure buildings”

Jack Rhysider · offsets 7631–7691

Stan MEMBER_OF GRU

Stan is described as a former Colonel and agent of the GRU.

Explicit Confidence 99% · Ira Winkler EP 21 Details

“Stan was a Colonel in the GRU before he defected over”

Ira Winkler · offsets 10964–11017

GRU ASSOCIATED_WITH Russia

The GRU is described as Russia's foreign intelligence agency.

Explicit Confidence 99% · Jack Rhysider EP 21 Details

“The GRU is Russia’s foreign intelligence agency”

Jack Rhysider · offsets 11025–11072

Stan USES social engineering

Stan used trust-building and conversations to get people to divulge government secrets.

Explicit Confidence 97% · Jack Rhysider EP 21 Details

“over time Stan would build trust with that person and get them to divulge government secrets”

Jack Rhysider · offsets 11843–11935

Tony USES social engineering

Tony is described as using telephone social engineering to elicit information.

Explicit Confidence 99% · Ira Winkler EP 21 Details

“we primarily used him for the telephone social engineering”

Ira Winkler · offsets 9596–9654

Tony USES human elicitation

Tony was trained to conduct interviews and elicit information.

Explicit Confidence 99% · Ira Winkler EP 21 Details

“he would know how to conduct interviews, he would know how to elicit information”

Ira Winkler · offsets 9761–9841

Stu USES physical intrusion

Stu assists Ira with physical intrusions and identifies physical weaknesses in buildings.

Explicit Confidence 98% · Jack Rhysider EP 21 Details

“He helps Ira whenever there’s a need for physical intrusions”

Jack Rhysider · offsets 8530–8590

Ira Winkler USES Google Maps

Ira used Google Maps and other tools to research the location and layout of the target facility.

Explicit Confidence 99% · Jack Rhysider EP 21 Details

“He used Google Maps and other tools to learn more”

Jack Rhysider · offsets 14885–14934

Ira Winkler USES .rhost entry

Ira says the team added a new .rhost entry to establish a trusted relationship with critical servers.

Explicit Confidence 99% · Ira Winkler EP 21 Details

“we just added a new .rhost entry”

Ira Winkler · offsets 19297–19329

Ira Winkler COMPROMISES computer operations center

Ira and his team gained access to and took control of the computers in the target computer operations center during the penetration test.

Explicit Confidence 98% · Ira Winkler EP 21 Details

“we physically compromised every – the critical information we needed”

Ira Winkler · offsets 19848–19916

“it was really unclimactic to actually take over control of all their computers in the RND center”

Ira Winkler · offsets 20206–20303

Chinese intelligence operation DISCOVERED_BY Stan

Stan identified what Ira calls a Chinese intelligence operation operating across the street from the research and development center.

Explicit Confidence 98% · Ira Winkler EP 21 Details

“Stan essentially found the Chinese intelligence operation operating across the street”

Ira Winkler · offsets 22373–22458

Chinese intelligence operation ATTRIBUTED_TO China

The operation is presented as likely connected to China, but the episode says there was only a high probability and offers multiple possible explanations for the restaurant's activity.

Uncertain Confidence 83% · Jack Rhysider EP 21 Details

“it’s a high probability that this Chinese restaurant was there to steal trade secrets from the company and send them back to China’s government agencies”

Jack Rhysider · offsets 22663–22815

Chinese intelligence operation INVOLVES social engineering

The episode describes the suspected operation as using social situations and questions to recruit or pressure people into disclosing information.

Uncertain Confidence 85% · Ira Winkler EP 21 Details

“What they do is they set up a social situation where people come in”

Ira Winkler · offsets 23186–23253

Transcript references

Works mentioned in the transcript. Distinct from show-note sources.

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T04:57:39.997756+00:00