Jack Rhysider AUTHORED Darknet Diaries
Jack says the show is made by him.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“This show is made by me, skid rock, Jack Rhysider.”
Episode
19 February 2019 Official episode · Official transcript
cybercrime carding
The episode follows the investigation, arrest, and prosecution of Roman Seleznev, a major carding-market operator associated with nCux, Track2, Bulba, and 2pac.cc. It covers payment-card malware, exposed Remote Desktop services, carding markets, digital forensics, international law enforcement, and related prosecutions.
Topics: Carding markets and sale of stolen payment-card dumps, Point-of-sale malware and payment-card scraping, Remote Desktop exposure on port 3389, Credential brute forcing and password reuse, Internet-wide scanning, Liberty Reserve and illicit financial transfers, Digital forensics and forensic disk imaging, Volume Shadow Copy Service evidence recovery, Pen-trap traffic metadata collection, International cybercrime investigations and extradition, Payment Card Industry compliance and breach costs
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Jack Rhysider AUTHORED Darknet Diaries
Jack says the show is made by him.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“This show is made by me, skid rock, Jack Rhysider.”
Roman Seleznev USES CarderWorld.cc
The actor used CardingWorld.cc to advertise and sell stolen credit-card dumps under the alias nCux.
Explicit Confidence 97% · Jack Rhysider EP 32 Details
“nCux would come up on the forum and go crazy selling dumps.”
Roman Seleznev USES Carder.su
The actor used Carder.su under the alias Track2 as a card-dump vendor.
Explicit Confidence 97% · Jack Rhysider EP 32 Details
“a new vendor showed up there named Track2”
Roman Seleznev USES Bulba.cc
The actor used Bulba.cc as an elite carder marketplace for stolen cards.
Explicit Confidence 97% · Jack Rhysider EP 32 Details
“you can then be invited to Bulba.cc, a more elite carder site”
Bulba.cc ASSOCIATED_WITH Track2.name
The detective determined that Bulba.cc and Track2.name were probably owned by the same person and appeared nearly identical.
Uncertain Confidence 93% · Jack Rhysider EP 32 Details
“The detective determined the websites were probably owned by the same person”
Roman Seleznev ASSOCIATED_WITH Track2.name
Track2.name was associated with Roman Seleznev through matching physical address, ICQ number, and account information; the episode presents this as connecting Track2 to Roman.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“nCux and Track2 and Bulba were all the same person”
2pac.cc OPERATED_BY Roman Seleznev
The Secret Service connected Roman Seleznev to being the person behind 2pac.cc.
Explicit Confidence 97% · Jack Rhysider EP 32 Details
“they found information that connected Roman Seleznev to be the person behind the 2pac.cc website”
Roman Seleznev USES Liberty Reserve
Roman used Liberty Reserve for financial transactions connected with his carding businesses.
Explicit Confidence 98% · Jack Rhysider EP 32 Details
“He found a lot of e-mails for transactions through Liberty Reserve”
Roman Seleznev DISCOVERED_BY United States Secret Service
The Secret Service discovered that the nCux identity was Roman Seleznev.
Explicit Confidence 98% · Jack Rhysider EP 32 Details
“they discovered his name was Roman Seleznev”
Roman Seleznev USES Kameo
The episode says Roman installed Kameo on exposed Windows computers to scrape payment-card data, although the episode also frames the attribution as presumptive in places.
Uncertain Confidence 90% · Jack Rhysider EP 32 Details
“he’d install malware on it to scrape the cards off it and then send it to his server”
“presumably by Roman Seleznev”
Roman Seleznev USES internet-wide scanning
Roman's server was used to mass-scan the internet for computers with Remote Desktop exposed.
Explicit Confidence 98% · Jack Rhysider EP 32 Details
“This server was being used to mass-scan the internet”
Roman Seleznev USES Credential brute force
After finding exposed Remote Desktop systems, the attacker attempted logins by cycling through commonly used usernames and passwords.
Explicit Confidence 98% · Jack Rhysider EP 32 Details
“attempt to brute force login to it by cycling through thousands of commonly-used usernames and passwords”
Roman Seleznev EXPLOITS Remote Desktop exposure
Roman exploited systems with Remote Desktop exposed to the internet, according to the episode's reconstruction of his activity.
Derived Confidence 94% · Jack Rhysider EP 32 Details
“Roman would hack into Windows computers that he would find exposed online”
Schlotzsky’s Deli compromise COMPROMISES RBS Worldpay
No claim: the catalog's Schlotzsky's incident concerns Schlotzsky's Deli, not RBS Worldpay.
Schlotzsky’s Deli compromise INVOLVES Kameo
The Schlotzsky's Deli compromise involved Kameo malware running on the registers.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“He found they both had malware running on them called Kameo with a K.”
Broadway Grill compromise INVOLVES Kameo
The Broadway Grill compromise involved a slightly different version of Kameo malware.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“These computers had the same Kameo malware that the detective found on the Schlotzsky’s Deli computers.”
Schlotzsky’s Deli compromise COMPROMISES RBS Worldpay
This is not supported by the transcript; the incident compromised Schlotzsky's Deli rather than RBS Worldpay.
RBS Worldpay breach INVOLVES Roman Seleznev
Federal prosecutors claimed Roman, along with fourteen others, hacked RBS Worldpay; Roman pleaded guilty to the charge.
Attributed Confidence 98% · Jack Rhysider EP 32 Details
“Federal prosecutors there claimed Roman, along with 14 other people, hacked into RBS Worldpay”
“Roman pleaded guilty to this, too.”
RBS Worldpay breach INVOLVES Payment-card dumping
The RBS Worldpay attackers stole thousands of credit cards and distributed the dumps to cashers.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“the hackers got in, stole thousands of credit cards, then gave it to fourteen different cashers around the world”
RBS Worldpay breach LEADS_TO PCI
The broader card breaches led victim businesses to face payment-card-industry compliance obligations and audits.
Derived Confidence 86% · Jack Rhysider EP 32 Details
“in order to process credit cards you must be compliant with the payment card industry, or PCI”
Carder.su OPERATED_BY Roman Seleznev
Roman pleaded guilty to being the owner of Carder.su, according to the episode.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“accused Roman of being the owner of Carder.su”
“Sure enough, it was true. Roman pleaded guilty to these charges”
Roman Seleznev TARGETS RBS Worldpay
The episode says Roman was accused of participating in the attack against RBS Worldpay.
Attributed Confidence 95% · Jack Rhysider EP 32 Details
“Roman was accused of stealing two million dollars himself.”
Kameo infected Windows computers, including the Windows systems used by the affected businesses; the transcript does not specifically say Kameo ran on Windows 8.
Derived Confidence 72% · Jack Rhysider EP 32 Details
“they’re just regular Windows computers running the cash register software”
Roman Seleznev USES Tor Browser
Forensic analysis found that Roman's laptop was last used with a Tor browser.
Explicit Confidence 96% · Jack Rhysider EP 32 Details
“the last application he used was a Tor browser”
Volume Shadow Copy Service AFFECTS Windows 8
The Windows 8 laptop had Volume Shadow Copy Service enabled and used it to retain snapshots of files.
Explicit Confidence 99% · Jack Rhysider EP 32 Details
“This computer was running Windows 8 and had the Volume Shadow Copy Service enabled.”
Broadway Grill compromise COMPROMISES RBS Worldpay
No claim: Broadway Grill and RBS Worldpay are separate incidents in the transcript.
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:32:44.322463+00:00