Episode
EP 21 — Black Duck Eggs
01 September 2018
Official episode
·
Official transcript
penetration test
social engineering
The episode features Ira Winkler and his former intelligence and Special Forces team conducting espionage simulations, penetration tests, social engineering, and physical intrusions against a major company's research and development facilities.
Topics: Social engineering and human elicitation, Penetration testing and espionage simulations, Physical intrusion and physical security weaknesses, Cryptanalysis and encryption, VPN access and preconfigured endpoint compromise, Privileged access to logged-on administrator systems, .rhost trusted-host configuration, Counterintelligence and detection of suspected foreign intelligence operations, Protection of research and development data and trade secrets
Official episode-page sources
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Entities (25)
Claims (21)
Qualified statements from this episode, not graph facts.
Ira Winkler
MEMBER_OF
National Signals Intelligence Operations Center
Ira says he took a job as an Intelligence Analyst for the National Signals Intelligence Operations Center.
Explicit
Confidence 99%
· Ira Winkler
EP 21
Details
“Finally I took a job as an Intelligence Analyst for the National Signals Intelligence Operations Center”
Ira Winkler ·
offsets 2759–2862
National Signals Intelligence Operations Center
PART_OF
National Security Agency
The National Signals Intelligence Operations Center is described as being within the NSA.
Explicit
Confidence 94%
· Ira Winkler
EP 21
Details
“which was the only room that actually looks cool in NSA”
Ira Winkler ·
offsets 2888–2943
Ira Winkler
USES
cryptanalysis
Ira worked on cryptanalysis and programmed supercomputers to perform it.
Explicit
Confidence 98%
· Ira Winkler
EP 21
Details
“My first technical computer job was programming super computers to do cryptanalysis”
Ira Winkler ·
offsets 3329–3412
Ira Winkler
USES
social engineering
Ira conducted a contract engagement using social engineering against an investment bank.
Explicit
Confidence 99%
· Jack Rhysider
EP 21
Details
“the contract was to use social engineering against an investment bank”
Jack Rhysider ·
offsets 4600–4669
Ira Winkler
USES
human elicitation
Ira says he used basic human elicitation techniques to obtain information from people over the phone.
Explicit
Confidence 99%
· Ira Winkler
EP 21
Details
“I just used essentially basic human elicitation techniques to lie to people over the phone”
Ira Winkler ·
offsets 4983–5073
Ira Winkler
USES
VPN
Ira obtained a computer preconfigured for the investment bank's VPN as part of the engagement.
Explicit
Confidence 90%
· Ira Winkler
EP 21
Details
“I even got the investment bank to send me a computer preconfigured for their VPN”
Ira Winkler ·
offsets 5762–5842
Ira Winkler
USES
penetration testing
Ira's career is described as social engineering and penetration testing, including testing unauthorized access to places and information.
Explicit
Confidence 99%
· Jack Rhysider
EP 21
Details
“That’s how Ira’s career got started as a social engineer and penetration tester”
Jack Rhysider ·
offsets 6596–6675
Ira Winkler
USES
espionage simulation
Ira says he specializes in assembling teams to conduct espionage simulations against organizations.
Explicit
Confidence 98%
· Ira Winkler
EP 21
Details
“I like to call them more espionage simulations”
Ira Winkler ·
offsets 7872–7918
Ira Winkler
USES
physical intrusion
Ira used a team to enter secure buildings and conduct physical intrusions as part of penetration-testing missions.
Derived
Confidence 90%
· Jack Rhysider
EP 21
Details
“using his crew to get into some of the most secure buildings”
Jack Rhysider ·
offsets 7631–7691
Stan
MEMBER_OF
GRU
Stan is described as a former Colonel and agent of the GRU.
Explicit
Confidence 99%
· Ira Winkler
EP 21
Details
“Stan was a Colonel in the GRU before he defected over”
Ira Winkler ·
offsets 10964–11017
GRU
ASSOCIATED_WITH
Russia
The GRU is described as Russia's foreign intelligence agency.
Explicit
Confidence 99%
· Jack Rhysider
EP 21
Details
“The GRU is Russia’s foreign intelligence agency”
Jack Rhysider ·
offsets 11025–11072
Stan
USES
social engineering
Stan used trust-building and conversations to get people to divulge government secrets.
Explicit
Confidence 97%
· Jack Rhysider
EP 21
Details
“over time Stan would build trust with that person and get them to divulge government secrets”
Jack Rhysider ·
offsets 11843–11935
Tony
USES
social engineering
Tony is described as using telephone social engineering to elicit information.
Explicit
Confidence 99%
· Ira Winkler
EP 21
Details
“we primarily used him for the telephone social engineering”
Ira Winkler ·
offsets 9596–9654
Tony
USES
human elicitation
Tony was trained to conduct interviews and elicit information.
Explicit
Confidence 99%
· Ira Winkler
EP 21
Details
“he would know how to conduct interviews, he would know how to elicit information”
Ira Winkler ·
offsets 9761–9841
Stu
USES
physical intrusion
Stu assists Ira with physical intrusions and identifies physical weaknesses in buildings.
Explicit
Confidence 98%
· Jack Rhysider
EP 21
Details
“He helps Ira whenever there’s a need for physical intrusions”
Jack Rhysider ·
offsets 8530–8590
Ira Winkler
USES
Google Maps
Ira used Google Maps and other tools to research the location and layout of the target facility.
Explicit
Confidence 99%
· Jack Rhysider
EP 21
Details
“He used Google Maps and other tools to learn more”
Jack Rhysider ·
offsets 14885–14934
Ira Winkler
USES
.rhost entry
Ira says the team added a new .rhost entry to establish a trusted relationship with critical servers.
Explicit
Confidence 99%
· Ira Winkler
EP 21
Details
“we just added a new .rhost entry”
Ira Winkler ·
offsets 19297–19329
Ira Winkler
COMPROMISES
computer operations center
Ira and his team gained access to and took control of the computers in the target computer operations center during the penetration test.
Explicit
Confidence 98%
· Ira Winkler
EP 21
Details
“we physically compromised every – the critical information we needed”
Ira Winkler ·
offsets 19848–19916
“it was really unclimactic to actually take over control of all their computers in the RND center”
Ira Winkler ·
offsets 20206–20303
Chinese intelligence operation
DISCOVERED_BY
Stan
Stan identified what Ira calls a Chinese intelligence operation operating across the street from the research and development center.
Explicit
Confidence 98%
· Ira Winkler
EP 21
Details
“Stan essentially found the Chinese intelligence operation operating across the street”
Ira Winkler ·
offsets 22373–22458
Chinese intelligence operation
ATTRIBUTED_TO
China
The operation is presented as likely connected to China, but the episode says there was only a high probability and offers multiple possible explanations for the restaurant's activity.
Uncertain
Confidence 83%
· Jack Rhysider
EP 21
Details
“it’s a high probability that this Chinese restaurant was there to steal trade secrets from the company and send them back to China’s government agencies”
Jack Rhysider ·
offsets 22663–22815
Chinese intelligence operation
INVOLVES
social engineering
The episode describes the suspected operation as using social situations and questions to recruit or pressure people into disclosing information.
Uncertain
Confidence 85%
· Ira Winkler
EP 21
Details
“What they do is they set up a social situation where people come in”
Ira Winkler ·
offsets 23186–23253
Transcript references
Works mentioned in the transcript. Distinct from show-note sources.
Extraction provenance
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19
· 2026-09-13T04:57:39.997756+00:00