Episode
24 November 2020 Official episode · Official transcript
mercenary
The episode examines the Dark Basin hack-for-hire operation, Citizen Lab’s investigation of its phishing infrastructure and targets, and links to BellTroX InfoTech Services and private investigators.
Topics: Targeted phishing and credential theft, Spear-phishing infrastructure, URL-shortener enumeration, Open-source intelligence and target clustering, Phishing-site log files and attack telemetry, Hack-for-hire operations, E-mail account compromise, Threat-actor attribution using timestamps, IP addresses, and infrastructure, Use of public profiles and exposed operational data, Legal and investigative limits in cyber-threat research
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Matthew Earl MEMBER_OF ShadowFall Capital Research
Matthew Earl identifies himself as the managing partner of ShadowFall Capital Research.
Explicit Confidence 99% · Matthew Earl EP 79 Details
“My name is Matthew Earl. I’m the managing partner of ShadowFall Capital Research.”
ShadowFall Capital Research ASSOCIATED_WITH Wirecard AG
ShadowFall Capital Research investigated Wirecard AG as a potential short-selling target.
Explicit Confidence 98% · Jack Rhysider EP 79 Details
“Back in 2015, Matthew started watching a German payment company called Wirecard AG.”
Dark Basin DISCOVERED_BY Citizen Lab
Citizen Lab investigated the phishing infrastructure and named the hacking group Dark Basin.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“Dark Basin was what Citizen Lab named this hacking group.”
Dark Basin USES phishing
Dark Basin sent phishing links to victims in crafted emails.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“E-mails were sent to victims with phishing links in them”
Dark Basin USES Credential phishing
The phishing sites used by Dark Basin requested victims’ login credentials, including email passwords.
Explicit Confidence 99% · Adam Hulcoop EP 79 Details
“the phishing site you land on knows who is coming and they can pre-load that text and pre-load that screen to make it look like – you’ve already been signed into your Gmail; just re-enter your password for us.”
Dark Basin USES URL shortener
Dark Basin used URL shorteners created with open-source software to conceal phishing destinations.
Explicit Confidence 98% · Adam Hulcoop EP 79 Details
“we found some suspicious links that were shortened using a URL shortener”
Citizen Lab USES Open-source intelligence
Citizen Lab’s investigation relied on open-source intelligence and publicly available data.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“their work is rooted in open-source intelligence, or OSINT”
Dark Basin SAME_AS Mercenary.Amanda
The episode presents Mercenary.Amanda as another name used by NortonLifeLock for the group Citizen Lab called Dark Basin.
Explicit Confidence 94% · Jack Rhysider EP 79 Details
“they were also tracking Dark Basin, but they called this group Mercenary.Amanda”
Dark Basin ASSOCIATED_WITH India
The timing, code, URL-shortener names, logs, and test IP addresses were suggestive of operators working out of India, but the episode notes that the timezone could have been falsified.
Uncertain Confidence 84% · Adam Hulcoop EP 79 Details
“each piece was another little bread crumb suggesting operators working out of India”
Dark Basin ASSOCIATED_WITH BellTroX InfoTech Services
The episode presents circumstantial evidence linking Dark Basin’s phishing activity to BellTroX InfoTech Services, rather than asserting a fully proven operational identity.
Uncertain Confidence 86% · Jack Rhysider EP 79 Details
“He was relieved when the Citizen Lab report came out linking the phishing to BellTroX”
Sumit Gupta MEMBER_OF BellTroX InfoTech Services
Sumit Gupta was identified as the owner of BellTroX and was also listed as being with the company under the alias Sumit Vishnoi.
Explicit Confidence 98% · John Scott-Railton EP 79 Details
“The owner of BellTroX has been indicted and charged”
“His profile says he’s with BellTroX”
BellTroX InfoTech Services USES phishing
BellTroX employees publicly displayed phishing pages and the company was described as offering email hacking and penetration services.
Explicit Confidence 97% · John Scott-Railton EP 79 Details
“Look at these swank-looking phishing pages that I’ve generated.”
BellTroX InfoTech Services ASSOCIATED_WITH Hack-for-hire
The episode portrays BellTroX as potentially operating as a hack-for-hire or mercenary hacking organization, while retaining some uncertainty about the full scope of its activity.
Uncertain Confidence 88% · Jack Rhysider EP 79 Details
“Was that real activity being Dark Basin a massive hack-for-hire mercenary outfit?”
Sumit Gupta USES Hack-for-hire
Sumit Gupta was identified as a hacker in the Visalus-related scheme in which private investigators hired hackers to access Ocean Avenue’s computers.
Explicit Confidence 97% · Jack Rhysider EP 79 Details
“One of the hackers was Sumit Gupta.”
Aviram Azari USES Hack-for-hire
Aviram Azari was indicted and arrested for allegedly engaging in a hack-for-hire scheme and conspiring with others to hack computers.
Attributed Confidence 96% · Jack Rhysider EP 79 Details
“Aviram Azari has been indicted and arrested for engaging in a hack-for-hire scheme.”
Jones Day ASSOCIATED_WITH Wirecard AG
Jones Day represented Wirecard and sent Matthew Earl a letter concerning his research and alleged conduct.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“It was from Jones Day, a law firm representing Wirecard.”
Kroll ASSOCIATED_WITH Wirecard AG
Kroll investigators visited Matthew Earl on behalf of Wirecard regarding his research into the company.
Explicit Confidence 98% · Jack Rhysider EP 79 Details
“The two men let him know that they were there on behalf of Wirecard”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:45:45.044324+00:00