Episode
03 September 2019 Official episode · Official transcript
cybercrime black hat
The episode continues the account of XBox Underground’s intrusions into Microsoft, game companies, and developer networks, including the theft and reconstruction of Durango prototypes, FIFA coin fraud, FBI investigations, arrests, prosecutions, and the group’s eventual dissolution.
Topics: Unauthorized access to Microsoft and game-company networks, Xbox Developer Network account access and privilege differences, SharePoint URL manipulation and exposure of internal files, Reverse engineering drivers, executables, and proprietary software, Reconstruction of an Xbox One/Durango prototype from leaked specifications, Durango OS installation on nonstandard hardware, FIFA coin generation through executable and server manipulation, Fraudulent Return Merchandise Authorizations for Cisco and Microsoft devices, Badge cloning and physical intrusion into Microsoft facilities, Leaked Xbox 360 boot-loader software, Chat logs, screenshots, informants, and digital evidence in criminal investigations, Seizure of computers, development kits, source code, and internal media, Probation restrictions on computers, internet access, and gaming devices
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
XBox Underground intrusions INVOLVES Epic Games
Jack says the XBox Underground crew had access to Epic Games' network.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“this XBox Underground hacking crew having full access to dozens of networks of video game companies like Epic”
XBox Underground intrusions INVOLVES Activision
Jack says the crew had access to Activision's network.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“networks of video game companies like Epic, Activision, EA”
XBox Underground intrusions INVOLVES Electronic Arts
Jack says the crew had access to Electronic Arts' network.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“networks of video game companies like Epic, Activision, EA, Bungee, Microsoft”
XBox Underground intrusions INVOLVES Microsoft
The campaign involved unauthorized access to Microsoft's networks and theft of internal materials.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“One of the networks they had access to was Microsoft itself”
XBox Underground intrusions INVOLVES Bungee
Jack lists Bungie among the video-game companies whose networks the crew accessed.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“Epic, Activision, EA, Bungee, Microsoft, Zombie Studios, and Steam”
XBox Underground intrusions INVOLVES Zombie Studios
Jack lists Zombie Studios among the companies whose networks the crew accessed.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“Microsoft, Zombie Studios, and Steam”
XBox Underground intrusions INVOLVES Steam
Jack lists Steam among the companies whose networks the crew accessed.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“Zombie Studios, and Steam”
XBox Underground intrusions INVOLVES source-code theft
The group focused on stealing video-game source code rather than credit cards or money.
Explicit Confidence 98% · Jack Rhysider EP 46 Details
“they’re all only after video games though, and source code”
XBox Underground intrusions INVOLVES Xbox Developer Network
The group used valid accounts to access the Xbox Developer Network and inspect developer permissions.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“They had a few valid logins for the XBox Developer’s Network”
Xbox Underground USES Xbox Developer Network
XBox Underground used valid logins to access the Xbox Developer Network.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“They had a few valid logins for the XBox Developer’s Network and they’d log in with different accounts”
XBox Underground intrusions INVOLVES SharePoint
The Microsoft server they accessed hosted a SharePoint site through which they viewed internal files.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“In this server was a SharePoint website”
XBox Underground intrusions INVOLVES Durango
The campaign involved obtaining specifications, software, and hardware information for Microsoft's Durango prototype.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“This hacker group was holding in their hands all of the ingredients and blueprints of the next XBox”
The episode identifies Durango as the code name for the Xbox One.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“the new [00:05:00] XBox which would be later known as the XBox One, but at that time, it was simply code-named Durango”
Nathan Leroux MEMBER_OF Xbox Underground
Dylan says Nathan was part of the group's core, although he did not play a large role.
Explicit Confidence 98% · Dylan EP 46 Details
“Nathan didn’t play a big role in it but Nathan was still part of the core group at the time”
Justin May MEMBER_OF Xbox Underground
Justin is described as an active member of the group and one of its hackers.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“Then there’s Justin May, or MTW, who got arrested at PAX but is still active in the group”
Austin MEMBER_OF Xbox Underground
Austin is described as being part of the group.
Explicit Confidence 98% · Jack Rhysider EP 46 Details
“Austin, who was part of the group too”
Anthony used FIFA-related hacking to create and sell in-game coins.
Explicit Confidence 97% · Jack Rhysider EP 46 Details
“Anthony decided to take what Nathan taught him and try to improve it”
“Anthony and Austin started making good money doing this”
Austin helped Anthony reverse-engineer FIFA and produce FIFA coins for sale.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“Austin, who was part of the group too, joined up and started helping Anthony make FIFA coins”
XBox Underground intrusions INVOLVES FIFA
The campaign later involved hacking FIFA to generate and sell in-game coins.
Explicit Confidence 98% · Sanad EP 46 Details
“They found a way to reverse-engineer the executable to basically have the server spit out unlimited coins”
Arman USES badge cloning
Arman cloned a Microsoft employee badge to enter Microsoft's headquarters.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“He acquired a badge cloner and when his mom’s boyfriend came back, he was able to make a duplicate copy of that Microsoft employee badge”
Using a cloned badge, Arman repeatedly entered Microsoft's campus and stole Durango prototypes from the building.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“For about a year, Arman would come and go on the Microsoft campus, becoming familiar with it”
“he grabbed one of these Durangos he found, shoved it in his backpack, and quickly left the building”
Arman USES Xbox Developer Network
Arman sought Xbox Developer Network logins as payment for an authentic Durango.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“Arman wanted logins to the XBox Developer Network and a few thousand dollars for it”
Arman contacted Austin to arrange the sale of an authentic Durango.
Explicit Direction flagged Confidence 94% · Jack Rhysider EP 46 Details
“he reached out to Austin, one of the members of this XBox Underground, to tell him about it”
Justin May USES Return Merchandise Authorization
Justin fraudulently requested replacement Cisco devices without returning the original devices, then sold the replacements.
Explicit Confidence 99% · Jack Rhysider EP 46 Details
“Justin knew this and figured out a way to trick Cisco into processing an RMA for him even though he didn’t have a router to send back”
Person A POSSIBLY_SAME_AS Justin May
Sanad inferred that Person A in the indictment was Justin because Justin was the only person they knew from Wilmington, Delaware; the identification is presented as an inference rather than established fact.
Uncertain Confidence 86% · Sanad EP 46 Details
“We all only knew one person from Wilmington, Delaware; Justin”
Justin May ATTRIBUTED_TO Federal Bureau of Investigation
The episode presents competing speculation that Justin may have been an FBI informant, while noting that nobody knew for sure.
Uncertain Direction flagged Confidence 78% · Jack Rhysider EP 46 Details
“Maybe Justin was an informant for the FBI and the whole thing was just set up to make Justin look good as an informant. Nobody knows”
Justin May DEVELOPED_BY Return Merchandise Authorization
Justin is described as having devised a way to abuse Cisco's RMA process; this is an unusual use of DEVELOPED_BY because the catalog has no separate scam artifact entity.
Derived Direction flagged Confidence 72% · Jack Rhysider EP 46 Details
“figured out a way to trick Cisco into processing an RMA for him”
Durango OS AFFECTS Gateway blade server
Sanad installed Durango OS on a Gateway blade server and said it loaded successfully.
Explicit Confidence 99% · Sanad EP 46 Details
“I put it on a Gateway blade server and it loaded completely fine”
Durango OS AFFECTS Windows 8
Sanad says Durango OS was based on Windows 8 at the time.
Explicit Confidence 98% · Sanad EP 46 Details
“it was based off of Windows 8 at the time”
XBox Underground intrusions INVOLVES internal Xbox 360 boot loader
Sanad received a leaked internal Xbox 360 boot loader associated with the hacking scene.
Explicit Confidence 99% · Sanad EP 46 Details
“he started talking about some internal XBox 360 boot loader that got leaked and he even sent me the file”
Dylan used eBay to list photographs of a purported Durango rather than building a second unit.
Explicit Confidence 99% · Dylan EP 46 Details
“I might as well put it on eBay and see what attention I can get from it”
Dylan DISCOVERED_BY Epic Games
Dylan disclosed to Epic Games that he was the person who had hacked them.
Explicit Direction flagged Confidence 99% · Dylan EP 46 Details
“I’m the guy who hacked you”
David MEMBER_OF Xbox Underground
David is described as one of the hackers involved in the group and as participating in its intrusions.
Explicit Confidence 98% · Jack Rhysider EP 46 Details
“there’s David who’s doing a lot of Halo modding and he’s fascinated with everything Microsoft”
Sanad MEMBER_OF Xbox Underground
Sanad is presented as one of the central participants in the XBox Underground story and later identified as a co-conspirator.
Explicit Confidence 93% · Jack Rhysider EP 46 Details
“Of course, we have Sanad”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:03:48.988174+00:00