Episode
05 July 2021 Official episode · Official transcript
cybercrime incident response
The episode describes a ransomware and unauthorized-access incident affecting a police department, including exposed Remote Desktop access, shared administrator credentials, phishing-based compromise of the mayor’s computer, and subsequent network remediation.
Topics: Ransomware response and recovery, Digital forensics and live memory acquisition, Packet capture with Wireshark, Direct internet exposure of Remote Desktop, Domain controller security, Shared administrator credentials, Phishing and credential theft, Keylogging, Least privilege, Incident-response evidence preservation, Backup testing and recovery readiness, Network segmentation and VPN-based remote access
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Nicole Beckwith MEMBER_OF U.S. Secret Service
Nicole Beckwith says she was sworn in as a task force officer for the Secret Service's Financial and Electronic Crimes Division.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“they swore me in as a task force officer for their Financial and Electronic Crimes Division”
police department ransomware incident INVOLVES Ransomware
The police department was hit by ransomware across its network.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“It was ransomware across the entire network.”
police department ransomware incident INVOLVES backup failure
The incident involved untested and outdated backups; the latest usable backup was ten months old.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“they did not test their backups prior to deploying them”
“The latest backup they had was from ten months ago.”
police department ransomware incident INVOLVES Domain controller
The attack involved the police department's domain controller, which was accessible and later used to stage malware.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“this police station’s domain controller was accessible from the internet over Remote Desktop”
police department ransomware incident COMPROMISES Domain controller
Unauthorized administrators logged into the domain controller and an attacker uploaded malware to stage another ransomware infection.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“this user did upload some malware and looks like they were staging it to infect the network with ransomware again”
police department ransomware incident INITIAL_ACCESS_VIA Remote Desktop exposure
The episode attributes the ransomware access to the domain controller being exposed to the internet through Remote Desktop.
Explicit Confidence 97% · Jack Rhysider EP 96 Details
“the police department was hit with ransomware because this system was accessible from the internet”
Remote Desktop exposure AFFECTS Remote Desktop
The vulnerability is the exposure of Remote Desktop directly to the public internet.
Explicit Confidence 99% · Jack Rhysider EP 96 Details
“accessible from the internet over Remote Desktop”
police department ransomware incident INVOLVES Remote Desktop
The attacker and legitimate users accessed the domain controller through Remote Desktop.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“admin credentials to this server, to RDP in”
police department ransomware incident INVOLVES phishing email
A later investigation found that a phishing email led to credentials being stolen from the mayor's computer.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“they were able to find a phishing e-mail. There was credentials stolen.”
police department ransomware incident INVOLVES keylogging
The attacker used a keystroke logger on the mayor's computer to observe credentials typed during a Remote Desktop login.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“The attacker put a keystroke logger on the computer and watched what the mayor did.”
police department ransomware incident INVOLVES shared administrator credentials
The incident involved shared administrator credentials used by the mayor, city council members, and others.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“we all have the admin credentials; they’re all the same”
the mayor of the city USES Remote Desktop
The mayor says he used Remote Desktop to access the police department server remotely to check email.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“logging into the police department’s domain server to check your e-mail”
“logging into this server through Remote Desktop”
police department ransomware incident INVOLVES the mayor of the city
The mayor's home computer and credentials were part of the attack path; the episode does not conclude that the mayor himself conducted the attack.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“There was somebody in the mayor’s computer that ended up gaining access to the server through the mayor’s home computer.”
Nicole Beckwith USES Volatility
Nicole used Volatility to dump memory and collect forensic data from the server.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“I immediately start dumping the memory, so Volatility is one of my hands-down favorite tools to use.”
Nicole Beckwith USES Wireshark
Nicole used Wireshark to capture network traffic during the live investigation.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“I started Wireshark up and I’m dumping network traffic to a USB also.”
Nicole Beckwith USES memory imaging
Nicole performed memory dumping or imaging as part of the forensic response.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“I immediately start dumping the memory”
Nicole Beckwith USES network traffic capture
Nicole captured network traffic for later analysis during the incident response.
Explicit Confidence 99% · Nicole Beckwith EP 96 Details
“I wanted to grab network traffic and so, I started Wireshark up and I’m dumping network traffic”
Jack Rhysider AUTHORED Darknet Diaries
Jack states that he made the Darknet Diaries show.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“This show is made by me”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:09:10.128494+00:00