Episode
08 June 2021 Official episode · Official transcript
incident response botnet cybercrime
Chris Davis describes tracking Curador, investigating and disrupting the Mariposa botnet, and later identifying another botnet affecting French critical infrastructure.
Topics: Botnet command-and-control infrastructure, DNS and dynamic DNS monitoring, Sinkholing and botnet disruption, Distributed denial-of-service attacks, Keystroke logging and credential theft, Malware toolkit distribution, Cross-border cybercrime investigations, Threat-actor attribution through infrastructure and log analysis, Critical-infrastructure compromise, Red-team exploitation and attack simulation
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Chris Davis USES red team operations
Chris Davis says he performed cybersecurity red-team work involving exploitation and attack simulations for Canadian federal government departments.
Explicit Confidence 99% · Chris Davis EP 94 Details
“A lot of it was doing cyber-security related red team work, so we’re doing exploitation or attack simulations.”
Defense Intelligence DEVELOPED_BY Chris Davis
Chris Davis started a company called Defense Intelligence after moving back to Ottawa.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“he started a company called Defense Intelligence.”
Chris Davis MEMBER_OF Dell
Chris Davis says he joined Dell and served as technical lead for its security team.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“I went down to Austin, Texas in 2005 and joined Dell.”
Chris Davis MEMBER_OF Damballa
Chris Davis joined David Dagon's anti-botnet company, Damballa.
Explicit Confidence 91% · Chris Davis EP 94 Details
“I can’t pay you as much but it’ll be more fun. I said absolutely, get me the hell outta here.”
Curador SAME_AS Raphael Gray
The episode identifies Curador as Raphael Gray.
Explicit Confidence 99% · Host6 EP 94 Details
“Curador is Raphael Gray, eighteen years old.”
Mariposa botnet INVOLVES Butterfly Bot
The Mariposa botnet incident involved systems infected with the Butterfly Bot malware.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“systems were being infected with something called the Butterfly Bot.”
Butterfly Bot USES distributed denial-of-service attack
Chris says the Butterfly Bot was capable of distributed denial-of-service attacks and that many DDoS attacks were observed.
Explicit Confidence 99% · Chris Davis EP 94 Details
“It was capable of distributed denial-of-service attacks”
Butterfly Bot USES keystroke logging
Chris says the Butterfly Bot was capable of keystroke logging.
Explicit Confidence 99% · Chris Davis EP 94 Details
“keystroke logging”
Butterfly Bot USES credential theft
Chris says credential theft occurred by default as soon as the malware was installed.
Explicit Confidence 99% · Chris Davis EP 94 Details
“By default, the credential theft would occur as soon as the thing was installed.”
Mariposa botnet INVOLVES Command and control
The Mariposa botnet relied on infected computers communicating with central command-and-control servers.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“Those servers they were reaching out to are known as command and control servers”
Mariposa botnet INVOLVES sinkholing
The Mariposa Working Group redirected the botnet's command-and-control domains to a sinkhole to observe infected systems and neutralize the botnet.
Explicit Confidence 99% · Chris Davis EP 94 Details
“We went ahead and did that; we pointed it all to our sinkhole”
Mariposa botnet INVOLVES Mariposa Working Group
The Mariposa incident involved a working group formed by Panda, Chris's organization, Georgia Tech, and others.
Explicit Confidence 99% · Chris Davis EP 94 Details
“we kinda put together this working group called the Mariposa Working Group”
Mariposa botnet INVOLVES Panda Security
Panda Security participated in analyzing the Butterfly Bot binaries and responding to the Mariposa botnet.
Explicit Confidence 98% · Chris Davis EP 94 Details
“We leaned on them to help with some language barrier stuff and to help us analyze the binaries.”
Mariposa botnet INVOLVES Georgia Tech
Georgia Tech participated in the Mariposa Working Group.
Explicit Confidence 99% · Chris Davis EP 94 Details
“the Mariposa Working Group which was Panda, ourselves, Georgia Tech, and a few other folks.”
Mariposa botnet ATTRIBUTED_TO DDT
The Spanish police reportedly determined that the Mariposa botnet was run by a cyber-gang called DDT.
Attributed Confidence 94% · Jack Rhysider EP 94 Details
“the Spanish police discovered this botnet was ran by a cyber-gang called the DDT.”
Ruiz is described as the leader of the DDT cyber-gang.
Attributed Confidence 94% · Jack Rhysider EP 94 Details
“A guy named Ruiz was the leader”
Rivera is described as part of the DDT cyber-gang.
Attributed Confidence 94% · Jack Rhysider EP 94 Details
“Rivera and Rios were also part of it.”
Rios is described as part of the DDT cyber-gang.
Attributed Confidence 94% · Jack Rhysider EP 94 Details
“Rivera and Rios were also part of it.”
Butterfly Bot DEVELOPED_BY Iserdo
The episode says Iserdo created the Butterfly Bot malware.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“Iserdo was arrested for being the creator of this malware.”
Iserdo created the NiceHash Bitcoin mining-pool website after leaving prison.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“He built a website called NiceHash”
France's critical infrastructure compromise TARGETS France
The incident targeted or affected French critical infrastructure, including the power grid, rail system, hospitals, banks, and water treatment systems.
Explicit Confidence 99% · Chris Davis EP 94 Details
“It was France’s power grid, like a bunch of nuclear power stations.”
France's critical infrastructure compromise INVOLVES Command and control
The French critical-infrastructure compromise involved systems repeatedly beaconing to command-and-control domains.
Explicit Confidence 94% · Chris Davis EP 94 Details
“we noticed that it was also France’s rail system, hospitals, banks, water treatment systems.”
France's critical infrastructure compromise ATTRIBUTED_TO Kasbah Hacker
Chris's investigation traced the suspected attacker to Morocco and he called the actor the Kasbah Hacker; the identification is presented as an investigative conclusion rather than an adjudicated fact.
Uncertain Confidence 82% · Jack Rhysider EP 94 Details
“Because the attacker was in Morocco, Chris called him the Kasbah Hacker”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:06:22.026621+00:00