Ghost Exodus SAME_AS Jesse McGraw
Jack states that Ghost Exodus was Jesse McGraw.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“Ghost Exodus was Jesse McGraw.”
Episode
21 July 2020 Official episode · Official transcript
black hat botnet hacktivism
The episode features Jesse McGraw, known online as Ghost Exodus, describing his involvement in the Electronik Tribulation Army, the compromise of computers at the Carrell Clinic, use of the Rxbot botnet, and the investigation that led to his arrest.
Topics: SCADA and industrial control system security, HVAC control systems in healthcare facilities, Botnet construction and operation, Denial-of-service attacks, Windows password hashes and password cracking, Bootable-media access to locked computers, Malware deployment through USB drives, Antivirus evasion, Persistent remote access, SQL injection, cross-site scripting, and phishing, Open-source intelligence investigation, Doxing and online harassment, Cybersecurity implications of medical-facility compromise, Automatic Identification System tracking
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Ghost Exodus SAME_AS Jesse McGraw
Jack states that Ghost Exodus was Jesse McGraw.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“Ghost Exodus was Jesse McGraw.”
Ghost Exodus MEMBER_OF Insane Masterminds Crew
Ghost Exodus says he was originally a member of the Insane Masterminds Crew.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“I originally was a member of the Insane Masterminds Crew.”
Electronik Tribulation Army DEVELOPED_BY Ghost Exodus
Ghost Exodus says he started his own hacking group, which became the Electronik Tribulation Army.
Derived Confidence 94% · Jack Rhysider EP 70 Details
“he was able to start his own hacking group, and he named it ETA.”
Electronik Tribulation Army USES SQL injection
Ghost Exodus says ETA initially practiced SQL injections.
Explicit Confidence 98% · Jack Rhysider EP 70 Details
“learning SQL injections”
Electronik Tribulation Army USES cross-site scripting
Ghost Exodus says ETA initially practiced cross-site scripting.
Explicit Confidence 98% · Jack Rhysider EP 70 Details
“and cross-site scripting”
Electronik Tribulation Army USES phishing
Ghost Exodus says ETA initially practiced phishing.
Explicit Confidence 98% · Jack Rhysider EP 70 Details
“and phishing”
Electronik Tribulation Army USES botnet
The episode describes ETA and Ghost Exodus as developing and using botnets.
Explicit Confidence 90% · Jack Rhysider EP 70 Details
“Ghost Exodus also had an interest in computers”
“He started playing around with botnets”
Ghost Exodus USES Rxbot
The botnet Ghost Exodus used in the clinic was identified as Rxbot.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“The botnet he was using was called Rxbot.”
Rxbot is described as the botnet used to add compromised computers to Ghost Exodus's botnet.
Derived Confidence 94% · Jack Rhysider EP 70 Details
“The botnet he was using was called Rxbot.”
Ghost Exodus USES denial-of-service attack
Ghost Exodus says he used the bots to launch attacks and later used the botnet to attack targets.
Explicit Confidence 98% · Jack Rhysider EP 70 Details
“I thought of doing was infecting as many computers as possible in order to launch this botnet attack”
“On several occasions, I attacked 94chan with them.”
Ghost Exodus COMPROMISES HVAC server
Ghost Exodus gained access to the clinic's HVAC server and established a persistent remote connection to it.
Explicit Confidence 98% · Jack Rhysider EP 70 Details
“With that, he was able to establish a persistent remote connection to this HVAC server.”
Ghost Exodus USES LogMeIn
Ghost Exodus says he used browser-based LogMeIn to remotely access the HVAC server.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“I decided to use the browser-based LogMeIn.”
Ghost Exodus USES Ophcrack
Ghost Exodus used Ophcrack to obtain passwords from locked Windows computers.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“He looked up how he could get into a locked computer and found a tool called Ophcrack.”
Ophcrack USES brute-force password cracking
Ophcrack is characterized as a brute-force password-cracking method for Windows password hashes.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“It’s sort of a brute-force password-cracking method”
Ghost Exodus USES brute-force password cracking
Ghost Exodus used Ophcrack's password-cracking process to access clinic computers.
Derived Confidence 97% · Jack Rhysider EP 70 Details
“He would put the Ophcrack CD in the tray, reboot the computer, wait for Ophcrack to find a password”
OpIran INVOLVES Neda Agha-Soltan
Ghost Exodus says he used his bots in OpIran in response to Neda Agha-Soltan's death.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“I used these bots in OpIran and in response to the death of Neda Agha-Soltan”
Ghost Exodus says the bots later identified as Rxbot were used in OpIran.
Derived Confidence 90% · Jack Rhysider EP 70 Details
“I used these bots in OpIran”
Immortal MEMBER_OF Electronik Tribulation Army
Immortal is described as a new recruit and member of the Electronik Tribulation Army.
Explicit Confidence 99% · Jack Rhysider EP 70 Details
“There was a new recruit in the ETA who went by the moniker Immortal.”
Wesley McGrew USES Open-source intelligence
Wesley McGrew used open-source intelligence and image searches to identify the facility shown in the screenshots.
Explicit Confidence 99% · Wesley McGrew EP 70 Details
“I started doing image searches and open-source intelligence based off the pictures”
McGrew Security DEVELOPED_BY Wesley McGrew
Wesley identifies McGrew Security as his information-security blog.
Explicit Confidence 96% · Wesley McGrew EP 70 Details
“Called mcgrewsecurity.com.”
Ghost Exodus DISCOVERED_BY Wesley McGrew
Wesley investigated the screenshots, identified the clinic, and collected information linking the activity to Ghost Exodus.
Explicit Direction flagged Confidence 98% · Jack Rhysider EP 70 Details
“I wanted to find out as much about Ghost Exodus as I could.”
“we contacted the Jackson, Mississippi FBI and handed that information over.”
Fixer MEMBER_OF Electronik Tribulation Army
Wesley describes Fixer as one of the members of McGraw's hacker group, the Electronik Tribulation Army.
Explicit Confidence 96% · Wesley McGrew EP 70 Details
“other members of McGraw’s hacker group, the Electronik Tribulation Army”
“he went by the handle Fixer”
Fixer USES denial-of-service attack
Wesley says Fixer conducted denial-of-service attacks against his website.
Explicit Confidence 99% · Wesley McGrew EP 70 Details
“he was the main bad actor along those lines, along the harassment lines”
“denial-of-service attacks against my website”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:32:35.721707+00:00