What if you got infected by a friend who wanted to spy on you? This is the story of how BlackShades spread to more than half a million machines, and 97 people got arrested.

Support for this show comes from Drata. Drata is the trust management platform that uses AI-driven automation to modernize governance, risk, and compliance, helping thousands of businesses stay audit-ready and scale securely. Learn more at drata.com/darknetdiaries.

Support for this show comes from Ramp. Ramp is a financial operations platform bringing spending visibility and control to AI. With Ramp, you can see spending across AI providers and set real-time controls and guardrails by team and model. Stop guessing where your AI spend is going. Get started with Ramp. Learn more at ramp.com/darknet.

Support for this show comes from ThreatLocker. ThreatLocker is a Zero Trust Platform that gives organizations control over what can run and what users and devices can access. It combines prevention with real time detection and automated response, helping security teams stop unauthorized activity and quickly contain compromised machines. Learn how ThreatLocker can strengthen your defenses at threatlocker.com/Darknet

View all active sponsors.

Full list of sources on the show page: https://darknetdiaries.com/episode/182/

Imagine driving down the road and your phone loses signal. Not just a lost signal, but it starts displaying SOS. Meaning no service configured at all. You can't make any calls, no data, no service. What goes through your head?

In this episode we hear from Ricky Handschumacher who learned how to slip inside a stranger’s phone, and would rummage through it looking for things he thought were valuable.

We also hear a story from Mark Kreitzman who started Efani because of people like Ricky.

Support for this show comes from DeleteMe. DeleteMe is a hands-free subscription service that will remove your personal information that’s being sold online to data brokers. Our mission is to provide everyone with the power to control their digital identity. We empower individuals and organizations to reclaim their privacy by removing personal data from online sources. For 20% off our privacy plans, please visit JoinDeleteMe.com/DarknetDiaries and use code: “darknet” at checkout.

This show is brought to you by Doppel. Doppel stops AI attacks with digital risk protection, human risk management, and email security on a unified social engineering defense platform. doppel.com

Support for this show comes from ThreatLocker. ThreatLocker is a Zero Trust Platform that gives organizations control over what can run and what users and devices can access. It combines prevention with real time detection and automated response, helping security teams stop unauthorized activity and quickly contain compromised machines. Learn how ThreatLocker can strengthen your defenses at threatlocker.com/Darknet.

View all active sponsors.

• https://www.youtube.com/watch?v=J7yLKVnQcNg&t=7s
• https://www.wsj.com/tech/cybersecurity/getting-cheated-in-a-videogame-led-him-to-a-world-of-online-crime-874392e7
• https://darknetdiaries.com/transcript/118/
• https://whatismyipaddress.com/mobile-security-sim-swapping

The word Conti struck fear in IT departments across the world. It's a type of ransomware that you hope to never come across. Like most ransomware gangs, the Conti group fell apart. But what's special about this story is how it fell apart. Because it fell apart in a very public, messy, scandalous way. Featuring investigative journalist Geoff White and cyber threat researcher Alex Holden.

This show is brought to you by Doppel. Doppel stops AI attacks with digital risk protection, human risk management, and email security on a unified social engineering defense platform. doppel.com

This show is sponsored by Maze. Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet for more information.

Support for this show comes from ThreatLocker. ThreatLocker is a Zero Trust Platform that gives organizations control over what can run and what users and devices can access. It combines prevention with real time detection and automated response, helping security teams stop unauthorized activity and quickly contain compromised machines. Learn how ThreatLocker can strengthen your defenses at threatlocker.com/Darknet.

View all active sponsors.

Full list of sources on the show page: https://darknetdiaries.com/episode/180/