COTTONMOUTH DEVELOPED_BY NSA
Jack states that the NSA created the device codenamed COTTONMOUTH.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“the NSA has created a device codenamed COTTONMOUTH”
Episode
10 December 2019 Official episode · Official transcript
advanced persistent threat
The episode examines the Shadow Brokers’ releases of alleged NSA and TAO cyber-weapons, including EternalBlue, and discusses their impact on incident response, vulnerability disclosure, and geopolitical cybersecurity.
Topics: NSA ANT catalogue and hardware implants, Tailored Access Operations and Equation Group attribution, Shadow Brokers exploit releases and auctions, EternalBlue and EternalRomance, SMB exploitation of Windows systems, Cisco and Fortinet firewall vulnerabilities, Windows event-log tampering and anti-forensics, Incident response and detection of missing audit records, Zero-day vulnerability retention and disclosure, Threat intelligence and analysis of leaked operational data, Information operations and politically timed cyber disclosures
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
COTTONMOUTH DEVELOPED_BY NSA
Jack states that the NSA created the device codenamed COTTONMOUTH.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“the NSA has created a device codenamed COTTONMOUTH”
Tailored Access Operations PART_OF NSA
TAO is described as a unit within the NSA.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“TAO stands for Tailored Access Operations, TAO. It’s a unit within NSA”
Equation Group ASSOCIATED_WITH Tailored Access Operations
Jack says it is believed that the people doing work for the Equation Group are specifically TAO within the NSA.
Uncertain Confidence 95% · Jack Rhysider EP 53 Details
“it’s believed that whoever is doing work for the Equation Group is specifically TAO within the NSA”
Shadow Brokers leaks ATTRIBUTED_TO Shadow Brokers
The leaks are described as hacking-tool dumps released by the group calling itself Shadow Brokers.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“the Shadow Brokers had leaked NSA hacking tools”
Shadow Brokers leaks CONTAINS EternalBlue
One Shadow Brokers dump contained the EternalBlue exploit.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“This dump contained EternalBlue and EternalRomance, among others”
Shadow Brokers leaks CONTAINS EternalRomance
One Shadow Brokers dump contained the EternalRomance exploit.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“This dump contained EternalBlue and EternalRomance, among others”
Windows event log editing exploit AFFECTS Microsoft Windows
The dumped exploit is described as enabling attackers to edit Windows event logs.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“The exploit they dumped means a hacker can edit an event log in Windows”
Windows event log editing exploit AFFECTS Windows event logs
The exploit can disable logging without creating an event and remove individual Windows events.
Explicit Confidence 97% · Jack Rhysider EP 53 Details
“you can disable logging without an event indicating logging has been turned off”
EternalBlue AFFECTS SMB
EternalBlue is described as remotely accessing Windows computers running SMB.
Explicit Confidence 96% · Jack Rhysider EP 53 Details
“an exploit that can be used to remotely access Windows computers running SMB”
exploit:cisco_and_fortinet_firewall_vulnerability EXPLOITS Cisco and Fortinet firewall vulnerability
The catalog contains an exploit for a Cisco and Fortinet firewall vulnerability that was previously unknown to those vendors.
Derived Direction flagged Confidence 90% · Jack Rhysider EP 53 Details
“The malware was a specific exploit for Cisco and Fortinet firewalls”
“Both Cisco and Fortinet confirmed this was a vulnerability they were not aware of”
Jake Williams MEMBER_OF Tailored Access Operations
Jack states that Jake had spent about five years in TAO and was a former member.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“Jake had spent almost two decades working in the information community for the government and about five years in TAO”
Shadow Brokers MENTIONS Jake Williams
The Shadow Brokers publicly identified Jake as a former Equation Group member; Jake says they were not guessing and knew his identity.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“you having a big mouth for former Equation Group member”
“they 100% were not guessing at who I was”
Shadow Brokers ASSOCIATED_WITH Russia
Jack says most signs point to Russia being behind the Shadow Brokers, but explicitly notes that this is not known for certain.
Uncertain Confidence 86% · Jack Rhysider EP 53 Details
“most signs do point to Russia being behind the Shadow Brokers, but we don’t know for certain”
Shadow Brokers leaks RELATED_TO Harold Martin III
Jack presents a theory that the Shadow Brokers data could have come from information Harold Martin stole, while emphasizing that there is no good evidence connecting him to the leaks.
Uncertain Confidence 88% · Jack Rhysider EP 53 Details
“The data on the Shadow Broker dumps could have been something that Harold stole”
“there’s no real good evidence that does connect Harold to this whole thing”
Andy Greenberg AUTHORED Sandworm
Jack says Andy Greenberg wrote the book Sandworm.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“Andy Greenberg from Wired. He just finished writing a new book called Sandworm”
Jack Rhysider REFERENCES Sandworm
Jack recommends Andy Greenberg’s book Sandworm as covering the Shadow Brokers and EternalBlue.
Explicit Confidence 98% · Jack Rhysider EP 53 Details
“if you want to check out his book, it’s Sandworm. It’s really good”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-12T17:31:58.205071+00:00