Dade REFERENCES Exploding the Phone
Dade says he is reading Exploding the Phone, a history of phone phreaking.
Explicit Confidence 99% · Dade EP 35 Details
“I’m reading Exploding the Phone. It’s about phone phreaking, kind of the history of it.”
Episode
02 April 2019 Official episode · Official transcript
cybercrime
The episode covers ATM attacks, Barnaby Jack’s ATM and medical-device research, and the Carbanak campaign targeting banks through phishing, malware, remote access, and fraudulent money transfers.
Topics: ATM jackpotting and physical ATM attacks, ATM firmware modification through USB, Remote ATM access and authentication bypass, Carbanak bank-targeting malware, Phishing through malicious Word documents, Keylogging and credential theft, Screen recording for operational reconnaissance, Domain-controller compromise and lateral movement, Command-and-control infrastructure discovery and seizure, Fraudulent SWIFT transfers, Database manipulation to inflate money-mule account balances, Use of Metasploit and Cobalt Strike, Embedded-device and medical-device security, ATM network interception and fake processing centers, Windows Sticky Keys abuse
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Dade REFERENCES Exploding the Phone
Dade says he is reading Exploding the Phone, a history of phone phreaking.
Explicit Confidence 99% · Dade EP 35 Details
“I’m reading Exploding the Phone. It’s about phone phreaking, kind of the history of it.”
Dade says the film Hackers inspired him to get into computers and influenced his hacker handle.
Explicit Confidence 99% · Dade EP 35 Details
“I picked my hacker handle because of that movie. It’s what inspired me to get into computers in the first place.”
Jornt v.d. Wiel MEMBER_OF Kaspersky Lab
Jornt identifies himself as a security researcher within Kaspersky Lab.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“My name is Jornt v.d. Wiel. I’m a security researcher within the Kaspersky Lab.”
Kaspersky Lab ASSOCIATED_WITH Russia
Jack says Kaspersky Lab is based in Moscow, Russia.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“Kaspersky Lab is based in Moscow, Russia”
ATM remote-login authentication bypass DISCOVERED_BY Barnaby Jack
Barnaby Jack found a vulnerability that bypassed authentication on an ATM remote login.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“Barnaby found a [00:10:00] vulnerability in the software to let him bypass that authentication altogether”
ATM remote-login authentication bypass AFFECTS ATM
The authentication-bypass vulnerability affected an ATM's remote-login software.
Derived Confidence 93% · Jack Rhysider EP 35 Details
“there was a remote login to the ATM but it had a username and password”
Barnaby Jack EXPLOITS ATM remote-login authentication bypass
Barnaby used the ATM authentication-bypass vulnerability to gain access without authenticating.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“allowing him to get right into the ATM”
Barnaby Jack USES firmware modification
Barnaby loaded custom firmware to control ATM functions.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“He was able to load a custom firmware onto a USB flash drive.”
Barnaby Jack USES ATM jackpotting
Barnaby demonstrated dispensing all cash from an ATM's cassettes, which he called jackpotting.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“The most astonishing thing he could do was dispense all of the cash from all the cassettes which he called jackpotting.”
Barnaby Jack USES ATM remote access
Barnaby remotely controlled an ATM after bypassing its remote-login authentication and replacing its firmware.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“Barnaby could now remote-control an ATM with his own custom firmware”
Toucan was installed on and operated within ATMs running Windows.
Explicit Confidence 98% · Jornt v.d. Wiel EP 35 Details
“an ATM is just a computer running Windows so it’s possible to install malware on it”
Toucan USES ATM jackpotting
Toucan provided a menu that allowed an operator to select cassettes and dispense their money.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“you basically get into the god-mode menu because you can choose from which cassettes you want the money”
The campaign was named Carbanak after investigators analyzed the malware used in the operation.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“At this point they decided to give this malware a name and they called it Carbanak.”
Jornt says Carbanak was based on malware called Carber.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“it was based on malware called Carber”
Carbanak ASSOCIATED_WITH Anunak
The name Carbanak incorporated the name of an Anunak configuration file.
Explicit Confidence 95% · Jornt v.d. Wiel EP 35 Details
“there was a configuration file called Anunak”
Carbanak DISCOVERED_BY Jornt v.d. Wiel
Jornt and his team analyzed the malware and named it Carbanak; Jornt is the identified investigator in the episode.
Derived Confidence 86% · Jornt v.d. Wiel EP 35 Details
“Jornt and his team have responded to a lot of banks with the same problem. They have a copy of the malware”
Carbanak INITIAL_ACCESS_VIA phishing
The campaign initially entered a bank through a phishing email sent to an employee.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“They send a spare phishing e-mail to an employee at the bank”
Carbanak INVOLVES exploit in patched Word vulnerability
The phishing Word document contained an exploit for a vulnerability that had already been patched.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“that Word document contained an exploit for an already patched vulnerability”
Carbanak INVOLVES keylogging
The attackers installed a keylogger to capture administrator passwords and other keystrokes.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“The hackers first installed a key logger on this person’s computer to record every keystroke”
Carbanak INVOLVES privilege escalation
The attackers attempted to elevate privileges by obtaining administrator passwords.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“the next goal would be to elevate their privileges and get access to the domain controller”
Carbanak INVOLVES lateral movement
After obtaining one administrator password, the attackers reused it on other servers and reached the domain controller.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“Now that they have the admin password to one of the computers they’ll try to use that password on another server.”
Carbanak INVOLVES screen recording
The attackers recorded an employee's screen to learn how the bank's IT and money-transfer systems worked.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“install video recording software on the machine of one of the employees”
One cash-out method was entering data directly into the Swift system to transfer money overseas.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“One way was to enter data directly into the Swift system and transfer money overseas.”
Carbanak INVOLVES ATM remote access
The attackers remotely controlled ATMs through an ATM administration server.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“One other way was to control the ATMs remotely like we saw with the first case.”
Carbanak INVOLVES ATM jackpotting
The attackers used remote ATM administration to dump all the bills from ATMs.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“they just started dumping all the bills out”
Carbanak USES money mule
The attackers created accounts and debit cards for money mules to withdraw stolen funds.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“They created all these accounts for their money mules.”
Carbanak USES Metasploit
After Carbanak signatures became known, the attackers switched to the off-the-shelf tool Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike”
Carbanak USES Cobalt Strike
After Carbanak signatures became known, the attackers switched to the off-the-shelf tool Cobalt Strike.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“they started using off-the-shelf tools such as Metasploit and Cobalt Strike”
The episode says most bank robberies associated with the group occurred in Ukraine and Russia.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“most bank robberies occurred in Ukraine and Russia”
The episode says most bank robberies associated with the group occurred in Ukraine and Russia.
Explicit Confidence 98% · Jack Rhysider EP 35 Details
“most bank robberies occurred in Ukraine and Russia”
The campaign later branched out to countries including Spain.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“it did start to branch out to various other countries like Spain and China”
The campaign later branched out to countries including China.
Explicit Confidence 96% · Jack Rhysider EP 35 Details
“it did start to branch out to various other countries like Spain and China”
Carbanak ASSOCIATED_WITH Europol
Europol tracked the group and reported a substantially higher estimate of the number of banks attacked and money stolen.
Attributed Confidence 99% · Jack Rhysider EP 35 Details
“Europol was also tracking this group and they had completely different numbers.”
Carbanak ASSOCIATED_WITH Dutch police
The Dutch police worked with Kaspersky researchers and seized a command-and-control server connected to the operation.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“we also decided to work on this case together with the Dutch police”
The FBI had a case on the group and shared information with other investigators.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“even the FBI had cases on this group and were sharing information”
Carbanak ASSOCIATED_WITH Russia
The episode presents the operators as Russian hackers or people fluent in Russian, so the Russian association is not certain.
Uncertain Confidence 84% · Jack Rhysider EP 35 Details
“Russian hackers or someone fluent in Russian found their way into a Russian bank’s network”
Denis K ASSOCIATED_WITH Ukraine
Jack says Denis K was from Ukraine and was arrested in Spain in connection with the operation.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“A guy named Denis K was arrested in Spain. He was from the Ukraine”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:37:12.601720+00:00