Episode
28 April 2020 Official episode · Official transcript
advanced persistent threat
The episode examines the 2004–2005 Vodafone Greece wiretapping affair, involving covert malware on Ericsson AXE telephone switches, abuse of lawful-intercept functionality, targeted Greek officials, the death of Vodafone engineer Kostas Tsalikidis, and later allegations involving U.S. intelligence operations.
Topics: Telecom lawful-intercept architecture, Ericsson AXE telephone exchanges, RES and IMS subsystems, PLEX reverse engineering, Covert malware persistence, Shadow-phone call interception, Command-parser backdoors, Log suppression and anti-forensics, Mobile-network signaling and cell-tower tracing, Incident response and evidence preservation, Insider access to telecom infrastructure, Targeted surveillance versus mass surveillance
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Panafon ASSOCIATED_WITH Vodafone Greece
Panafon was renamed Vodafone-Panafon after its acquisition by Vodafone and became known as Vodafone Greece.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“Panafon was re-named to Vodafone-Panafon but it’s just better known as Vodafone Greece.”
Vodafone Greece wiretapping affair INVOLVES Vodafone Greece
The wiretapping affair involved Vodafone Greece’s telecom systems and network.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“The Vodafone systems had the malware installed in two of their central offices and four of their switches”
Vodafone Greece wiretapping affair COMPROMISES Vodafone Greece
The hackers gained access to Vodafone Greece’s systems and used them to conduct illegal wiretaps.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“Whoever did this essentially hacked their way into Vodafone’s systems and secretly activated this software.”
Vodafone Greece wiretapping affair INVOLVES Vodafone Greece wiretapping malware
The affair involved deeply embedded rogue software that Ericsson identified as malware.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“Ericsson came to the conclusion this is malware, deeply imbedded, sophisticated rogue software”
Vodafone Greece wiretapping malware DISCOVERED_BY Ericsson
Ericsson discovered the unusual executable files and determined that they constituted malware.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“Ericsson had some big news for Vodafone Greece. They’d been digging around on these devices”
“Ericsson came to the conclusion this is malware”
Vodafone Greece wiretapping affair INVOLVES AXE
The malware was installed on Ericsson AXE exchange devices used by Vodafone Greece.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“These AXE devices were exchanges that Vodafone Greece used.”
The AXE exchange software was written in PLEX code.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“The software was all written in PLEX code”
Remote-control equipment subsystem DEVELOPED_BY Ericsson
Ericsson implemented the RES lawful-interception technology in its telephone switches.
Explicit Confidence 98% · Jack Rhysider EP 64 Details
“On the tech side, Ericsson implemented lawful intercept technology directly into their telephone switches.”
Interception management system DEVELOPED_BY Ericsson
The IMS interface was part of Ericsson’s lawful-interception technology.
Derived Confidence 91% · Jack Rhysider EP 64 Details
“Then there’s the interception management system, or IMS, which is the user interface that controls this wiretapping feature.”
Vodafone Greece wiretapping malware USES Remote-control equipment subsystem
The malware secretly activated and used Ericsson’s RES subsystem to conduct wiretaps.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“the malware was using Ericsson’s own lawful intercept technology installed on Vodafone Greece’s systems to carry out the wiretaps.”
Vodafone Greece USES Remote-control equipment subsystem
RES was included in Vodafone Greece’s AXE upgrade, although Vodafone did not purchase or activate the IMS front end.
Explicit Confidence 98% · Jack Rhysider EP 64 Details
“they updated their AXE, the exchange switch, with Ericsson back in 2003 which included the RES software as standard.”
Vodafone Greece wiretapping affair INVOLVES shadow phones
The intercepted calls were routed to fourteen shadow cell-phone lines used by the hackers.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“hackers had a total of fourteen shadow cell phone lines which would pick up and listen to any of the phones that were on that list”
Vodafone Greece wiretapping malware USES shadow phones
The malware sent intercepted-call metadata and audio through shadow phones rather than directly to a law-enforcement interface.
Explicit Confidence 98% · Jack Rhysider EP 64 Details
“the data was sent to shadow cell phones instead”
Vodafone Greece wiretapping malware USES covert backdoor
The malware included a back door that enabled later access and changes to the exchange switches.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“They included a back door so they could always get back in and make changes or updates.”
Vodafone Greece wiretapping malware USES log tampering
The malware could shut down transaction logs and silence alarms, hiding the wiretapping activity.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“It shut down the exchange’s transaction logs and silenced any alarms”
Vodafone Greece wiretapping affair INVOLVES wiretapping
The affair involved illegal wiretapping of 106 cell-phone numbers, including senior Greek officials.
Explicit Confidence 99% · Jack Rhysider EP 64 Details
“Whoever put it there was listening in to calls of 106 cell phone numbers.”
William Basil MEMBER_OF Central Intelligence Agency
James Bamford described William Basil as a CIA agent.
Attributed Confidence 94% · Jack Rhysider EP 64 Details
“they used a CIA agent named William Basil.”
National Security Agency ASSOCIATED_WITH Hellenic National Intelligence Service
According to Snowden documents described by Jack, the NSA worked with the Greek National Intelligence Service before the Olympics.
Attributed Confidence 92% · Jack Rhysider EP 64 Details
“the NSA started working with the Greek National Intelligence Service in the two years running up to the games.”
National Security Agency ASSOCIATED_WITH Vodafone Greece wiretapping affair
James Bamford alleged that the NSA obtained Greek permission to enter the telecom system for Olympic security and later used the operation to monitor Greek officials; this is an attributed, contested account.
Attributed Confidence 88% · James Bamford EP 64 Details
“they got the permission from the Greek government to come in and do the bugging.”
“now they’re secretly turning it on the Greek government; they’re turning it on the prime minister, his wife.”
National Security Agency USES Vodafone Greece wiretapping malware
In James Bamford’s account, the NSA operation involved obtaining malware, placing it in Vodafone, and exfiltrating intercepted communications; the attribution is not officially established in the episode.
Attributed Confidence 84% · James Bamford EP 64 Details
“you’ve got the agreement of the government, you’ve got the inside person, you’ve got the malware”
“then you exfiltrate the intercepting communications to these untraceable cell phones and then that puts it into NSA.”
William Basil ASSOCIATED_WITH Vodafone Greece wiretapping affair
Greek authorities reportedly issued an arrest warrant for Basil as a suspected CIA agent involved in the Vodafone wiretapping attack; his precise role remained unresolved.
Uncertain Confidence 90% · Jack Rhysider EP 64 Details
“the Greek government had issued an international arrest warrant for William Basil as a suspected CIA agent working out of the US embassy in Athens.”
Skyship 600 OPERATED_BY Skycruise Switzerland
The Skyship 600 blimp was owned by Skycruise Switzerland.
Explicit Direction flagged Confidence 99% · Spkr2 EP 64 Details
“The blimp was called Skyship 600 owned by Skycruise Switzerland”
Vodafone Greece wiretapping affair INVOLVES Skyship 600
A participant claimed that the Skyship 600 was operating in Athens while the wiretapping was taking place and had equipment capable of intercepting phone calls from the air.
Attributed Confidence 72% · Spkr2 EP 64 Details
“at the same time this wiretapping was going on there was a massive blimp”
The Athens Affair MENTIONS Vodafone Greece wiretapping affair
The article The Athens Affair discussed the ADAE report and the technical details of the Vodafone wiretapping case.
Explicit Confidence 98% · Jack Rhysider EP 64 Details
“there is a fascinating article in the IEEE Spectrum, a technical magazine, which goes over this ADAE report. It’s called The Athens Affair”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:24:51.790416+00:00