Episode
01 October 2019 Official episode · Official transcript
advanced persistent threat
The episode examines the alleged GCHQ intrusion into Belgacom, the Quantum Insert technique, and the Regin malware framework, while discussing the uncertainty surrounding attribution and the legal and diplomatic consequences.
Topics: Nation-state cyber espionage and attribution, Advanced Persistent Threats, Operation Socialist and the alleged Belgacom intrusion, Quantum Insert traffic injection, Man-in-the-middle and man-on-the-side techniques, Timing-based web response attacks, Cloned phishing websites, Regin’s modular malware architecture, Multi-stage encrypted malware, Malware command-and-control communications, Covert channels using UDP, TCP, HTTP cookies, SSL, and SMB, Virtual IP addresses and VPN concealment, GSM/mobile-network compromise, Exfiltration obfuscation across packet attributes, Zero-day exploitation, Telecommunications backbone compromise, Incident response and covert remediation, Legal and diplomatic consequences of intelligence operations
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Belgacom SAME_AS Proximus Group
The episode states that Belgacom is now called Proximus Group.
Explicit Confidence 99% · Jack Rhysider EP 48 Details
“It’s actually now called Proximus Group now, but the story takes place when it was known as Belgacom.”
BICS is described as another company belonging to Belgacom.
Explicit Confidence 93% · Jack Rhysider EP 48 Details
“they have another company called BICS which is the Belgacom International Carrier Services”
Operation Socialist TARGETS Belgacom
Operation Socialist was the name given to the operation targeting Belgacom, according to the leaked GCHQ presentation.
Attributed Confidence 96% · Jack Rhysider EP 48 Details
“the GCHQ called this attack Operation Socialist”
Operation Socialist ATTRIBUTED_TO GCHQ
The attack was attributed to GCHQ by documents from the Snowden archive, but the episode emphasizes that this attribution was alleged and contested.
Attributed Confidence 90% · Jack Rhysider EP 48 Details
“They said the cyber-attack on Belgacom was carried out by Britain’s GCHQ”
Operation Socialist COMPROMISES Belgacom
The alleged Operation Socialist intrusion compromised Belgacom's internal network and systems.
Uncertain Confidence 90% · Jack Rhysider EP 48 Details
“the cyber-attack on Belgacom”
“the attack on Belgacom”
Operation Socialist INITIAL_ACCESS_VIA Quantum Insert
The episode presents Quantum Insert as the alleged method used to obtain initial access to Belgacom's network.
Uncertain Confidence 88% · Jack Rhysider EP 48 Details
“what they used was a technology that the NSA developed called Quantum Insert”
“the NSA helped the GCHQ conduct these attacks to get the initial access”
Operation Socialist INVOLVES Regin
Regin was later matched to the malware found on Belgacom during the alleged operation.
Derived Confidence 92% · Jack Rhysider EP 48 Details
“Regin was matched with the malware found on the Belgacom systems”
Quantum Insert DEVELOPED_BY National Security Agency
Quantum Insert is described as a technology developed by the NSA.
Explicit Direction flagged Confidence 98% · Jack Rhysider EP 48 Details
“a technology that the NSA developed called Quantum Insert”
Quantum Insert USES Quantum Server
The Quantum Insert method uses a Quantum Server to respond faster than the legitimate web server.
Explicit Confidence 95% · Jack Rhysider EP 48 Details
“For this to work, they use something called a Quantum Server”
Quantum Insert ASSOCIATED_WITH man-in-the-middle attack
The episode compares Quantum Insert to a man-in-the-middle attack.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“This is sort of like a man-in-the-middle attack”
Quantum Insert ASSOCIATED_WITH timing attack
Quantum Insert is also characterized as a timing attack because the fake site must respond faster than the real site.
Explicit Confidence 98% · Jack Rhysider EP 48 Details
“but it’s also a timing attack because the fake LinkedIn site has to respond quicker than the real one”
Quantum Insert ASSOCIATED_WITH man-on-the-side attack
The episode notes that some people call this type of traffic injection a man-on-the-side attack.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“some call it a man-on-the-side attack”
Regin was used against Belgacom's systems, including systems used by administrators and network infrastructure.
Derived Confidence 95% · Jack Rhysider EP 48 Details
“After the Quantum Insert phishing method was done on Belgacom, then this malware was installed on the target’s computers which was called Regin.”
Regin TARGETS European Commission
Regin was involved in an attack in which the European Commission discovered that it had been hacked.
Explicit Confidence 94% · Jack Rhysider EP 48 Details
“the European Commission discovered it had been hacked”
Regin TARGETS European Council
The episode states that multiple European Council systems were infected in the same attack involving Regin.
Explicit Confidence 93% · Jack Rhysider EP 48 Details
“Multiple systems at the European Commission and European Council were infected”
Researchers found similarities between Regin and Flame, which the episode describes as a spy tool.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Analysis of Regin revealed some similar features to other malware like Flame and Duqu.”
Researchers found similarities between Regin and Duqu.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Analysis of Regin revealed some similar features to other malware like Flame and Duqu.”
Duqu ATTRIBUTED_TO National Security Agency
Duqu is described as thought to have been created by the NSA, so the attribution is uncertain.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Duqu is thought to be created by the NSA and Unit 8200 in Israel”
Duqu is described as thought to have been created by Unit 8200 and the NSA, not as a confirmed attribution.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Duqu is thought to be created by the NSA and Unit 8200 in Israel”
Flame ATTRIBUTED_TO National Security Agency
Flame is described as thought to have been created by the NSA and GCHQ, so the attribution is uncertain.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Flame is thought to be created by the NSA and GCHQ.”
Flame is described as thought to have been created by GCHQ and the NSA, so the attribution is uncertain.
Uncertain Confidence 78% · Jack Rhysider EP 48 Details
“Flame is thought to be created by the NSA and GCHQ.”
Regin is described as capable of infiltrating GSM systems.
Explicit Confidence 98% · Jack Rhysider EP 48 Details
“it has the ability to infiltrate [00:35:00] GSM systems”
Regin AFFECTS mobile base station
The episode equates the GSM systems affected by Regin with mobile base stations and says this could give attackers control over mobile networks.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“GSM systems which are mobile base stations, giving the hackers control over mobile networks”
Regin USES command and control server
Regin uses command-and-control infrastructure to communicate with attackers and transfer collected data.
Explicit Confidence 95% · Jack Rhysider EP 48 Details
“the infected systems talk to each other first on the network and then through a central hub which then communicates back to the command servers”
Regin assigns an infected machine a virtual IP address that forms a VPN layer over the network.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“This forms a VPN layer on top of everything else.”
Regin used SSL as one of several covert transport channels.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“A lot was done over your typical SSL and even SMB.”
Regin USES Server Message Block
Regin used SMB as one of several covert transport channels.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“A lot was done over your typical SSL and even SMB.”
Symantec exposed Regin in a 2014 report.
Explicit Confidence 97% · Jack Rhysider EP 48 Details
“In November 2014, Symantec exposed a serious and advanced malware framework they referred to as Regin”
Kaspersky followed Symantec with its own report on Regin and had been tracking it since 2012.
Explicit Confidence 96% · Jack Rhysider EP 48 Details
“Kaspersky immediately followed up with a report of their own”
Trinity was the Belgian investigation into the cyber-attack against Belgacom.
Explicit Confidence 98% · Jack Rhysider EP 48 Details
“They code-named their investigation Trinity.”
“The Trinity investigation into this cyber-attack”
Trinity INVOLVES Federal Public Prosecutor in Belgium
The Belgian federal prosecutors participated in and ultimately received the confidential report from the Trinity investigation.
Explicit Confidence 94% · Jack Rhysider EP 48 Details
“The Belgian federal prosecutors submitted their confidential investigation report to the Belgian government.”
GCHQ ASSOCIATED_WITH National Security Agency
Snowden-related reporting described GCHQ as sharing collected data with the NSA; this is presented as an attributed surveillance relationship.
Attributed Confidence 93% · Jack Rhysider EP 48 Details
“sharing this data with the NSA”
GCHQ OPERATED_BY United Kingdom
GCHQ is identified as the United Kingdom's government communications headquarters.
Explicit Confidence 90% · Jack Rhysider EP 48 Details
“GCHQ, or the Government Communication Headquarters, is like the NSA but in England.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:07:06.153909+00:00