David MEMBER_OF National Security Agency
David worked as an analyst for the NSA from approximately August 2011 to August 2014.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“He started working for the NSA as an analyst there.”
Episode
17 September 2019 Official episode · Official transcript
mercenary advanced persistent threat
The episode discusses Project Raven, a UAE-linked offensive cyber-operations unit staffed largely by former American intelligence and military personnel, its targeting of foreign governments, journalists, and human-rights activists, the Karma iPhone spyware tool, and its later transition to DarkMatter.
Topics: Foreign offensive cyber operations and cyber-mercenary contracting, Targeting of government networks through default VPN credentials, Managed service provider compromise and downstream access to multiple government clients, Lateral movement, credential theft, pass-the-hash, and persistence, ASPX web-shell deployment through a file-upload vulnerability, Phishing and spyware delivery through email, tweets, and shortened URLs, Non-interaction iPhone exploitation through crafted iMessage content, Vulnerability disclosure and vendor patching by Google Project Zero, Root certificate authorities and browser trust, Collection and exfiltration of communications, location data, and other personal information
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
David MEMBER_OF National Security Agency
David worked as an analyst for the NSA from approximately August 2011 to August 2014.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“He started working for the NSA as an analyst there.”
David MEMBER_OF CyberPoint
David accepted a position with CyberPoint after leaving the NSA.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“There was this recruiter from a company called CyberPoint.”
Project Raven PART_OF CyberPoint
Project Raven was described as a hacking unit operating within or for CyberPoint.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“Project Raven was a hacking unit working for a company called Cyber Point”
David MEMBER_OF Project Raven
David was assigned to the Project Raven hacking unit after moving to Abu Dhabi.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“The name of the hacking unit Dave was assigned to was called Project Raven.”
Project Raven ASSOCIATED_WITH NISSA
Project Raven was tasked with helping NISSA conduct offensive cyber operations and collect information from targets.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“you’re gonna be helping NISSA conduct offensive cyber operations”
NISSA ASSOCIATED_WITH United Arab Emirates
NISSA was described as a secret part of the UAE government, analogous to the NSA.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“NISSA was the secret part of the UAE government which is similar to the NSA”
Project Raven ATTRIBUTED_TO United Arab Emirates
The episode attributes Project Raven's hacking operations and contracting to the UAE government.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 47 Details
“It was the UAE government who was hiring them to conduct these hacks.”
Project Raven USES phishing
Project Raven personnel taught Emiratis how to establish phishing emails as an access method.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“how to set up a phishing e-mail and use Metasploit to gain access”
Project Raven USES Metasploit
Project Raven used or taught the use of Metasploit to gain access to victims' machines.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“use Metasploit to gain access to the victim’s machine”
Project Raven USES default credentials
Project Raven gained initial access to a government VPN using default credentials.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“That VPN was using default credentials.”
Project Raven USES web shell
The team uploaded an ASPX web shell through the Managed Engine ticket system to obtain access to a server.
Explicit Confidence 99% · David EP 47 Details
“you put an ASPX web shell on there, upload it as part of that ticket”
Project Raven USES lateral movement
David described moving laterally through compromised networks to reach additional systems and credentials.
Explicit Confidence 98% · David EP 47 Details
“login remotely until you get where you want to go to the domain controller”
Project Raven USES pass the hash
The team used pass-the-hash or plaintext credentials for remote access during lateral movement.
Explicit Confidence 99% · David EP 47 Details
“passing the hash or even the plain text password”
Project Raven USES living off the land
The team used living-off-the-land methods, including native network utilities, during lateral movement.
Explicit Confidence 98% · David EP 47 Details
“living off the land, your net bios, your SMB”
Project Raven USES Data exfiltration
Project Raven collected communications and other data from targets rather than conducting destructive operations.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“This was just collecting communications.”
David installed ESXI on a home Mac Pro server while building a personal cybersecurity lab.
Explicit Confidence 99% · David EP 47 Details
“installed ESXI on that, and started building stacks”
Rori Donaghy USES WordPress
Rori used WordPress to create the human-rights website and blog for the Emirates Center for Human Rights.
Explicit Confidence 99% · Rori Donaghy EP 47 Details
“it was effectively just a WordPress website and the blog”
Lori Stroud MEMBER_OF Booz Allen Hamilton
Before Project Raven, Lori worked as a technology consultant for Booz Allen Hamilton.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“Lori was a technology consultant for a company called Booz Allen Hamilton.”
Lori Stroud MEMBER_OF National Security Agency
Lori worked for the NSA before joining Project Raven.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“After that, she went on to work for the NSA.”
Lori Stroud MEMBER_OF Project Raven
Lori worked on the analysis team at Project Raven.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“One of the people in that analysis team was named Lori Stroud.”
Lori Stroud MEMBER_OF DarkMatter
Lori moved from Project Raven to DarkMatter after the UAE terminated the Project Raven contract.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“Lori was one of the ones that moved onto DarkMatter.”
DarkMatter ASSOCIATED_WITH United Arab Emirates
DarkMatter was described as a UAE company owned and operated by UAE citizens.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“DarkMatter is a UAE company owned and operated by UAE citizens.”
DarkMatter ASSOCIATED_WITH NISSA
The episode says DarkMatter continued working with the UAE government and NISSA, with the speaker hedging that it was probably continuing the espionage.
Uncertain Confidence 95% · Jack Rhysider EP 47 Details
“DarkMatter is operating and working with the UAE government and NISSA.”
Project Raven USES Karma
Project Raven had access to and used, or could use, the Karma iPhone-hacking tool; the episode does not establish that David personally used it.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“Project Raven had access to this crazy hacking tool called Karma.”
Karma EXPLOITS iMessage flaw
Karma appears to have exploited an iMessage flaw, but the episode explicitly says this is not certain.
Uncertain Confidence 91% · Jack Rhysider EP 47 Details
“it looks like it was exploiting a flaw in Apple’s iMessage”
Karma was described as being enabled by sending a crafted text through iMessage without user interaction.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“By sending this crafted text through iMessage, it enables the exploit.”
Karma targeted iPhones and could reportedly extract data without requiring the user to click or interact.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“you can target iPhones with it”
Natalie Silvanovich MEMBER_OF Project Zero
Natalie works on Google's Project Zero team.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“Natalie works for Project Zero”
iMessage flaw DISCOVERED_BY Natalie Silvanovich
Natalie discovered three iPhone vulnerabilities while investigating how a Karma-like exploit might work; the episode does not establish that these were the exact Karma vulnerabilities.
Uncertain Confidence 88% · Jack Rhysider EP 47 Details
“she found three vulnerabilities on the iPhone”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:05:18.902663+00:00