182: Blackshades

What if you got infected by a friend who wanted to spy on you? This is the story of how BlackShades spread to more than half a million machines, and 97 people got arrested. SponsorsSupport for this show comes from Drata https://drata.com/darknetdiaries. Drata is the trust management platform that uses AI-driven automation to modernize governance, risk, and compliance, helping thousands of businesses stay audit-ready and scale securely. Learn more at drata.com/darknetdiaries https://drata.com/darknetdiaries. Support for this show comes from Ramp https://ramp.com/darknet. Ramp is a financial operations platform bringing spending visibility and control to AI. With Ramp, you can see spending across AI providers and set real-time controls and guardrails by team and model. Stop guessing where your AI spend is going. Get started with Ramp. Learn more at ramp.com/darknet https://ramp.com/darknet. Support for this show comes from ThreatLocker https://threatlocker.com/Darknet. ThreatLocker is a Zero Trust Platform that gives organizations control over what can run and what users and devices can access. It combines prevention with real time detection and automated response, helping security teams stop unauthorized activity and quickly contain compromised machines. Learn how ThreatLocker can strengthen your defenses at threatlocker.com/Darknet https://threatlocker.com/Darknet View all active sponsors. https://darknetdiaries.com/sponsors/ SourcesFull list of sources on the show page: https://darknetdiaries.com/episode/182/

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  Have you ever tried installing an app on your computer, but then ended up with something else? Like you downloaded something you actually wanted, like an app to retrieve a deleted file or to get some video to play properly. You get it on your machine, the way everyone does. You downloaded it, run the installer, click through the screens, next, next, next, agree, and then it's installed. But then, something strange happens. You might not notice right away, but there's something new on your computer, a new app or toolbar in your browser, or maybe your homepage changed to something like a search engine you've never heard of. And your computer seems to be doing something every now and then that just doesn't make sense. Like, it's a tad slower, or the fans are suddenly louder. But you're just not exactly sure why. Most of the time, it's relatively harmless.

• 0:44Jack Rhysider?

  It's some kind of junkware. Some company paid a few cents to bundle their stuff into your download, hoping that you wouldn't remove the software and you would start using their software. It's annoying, but it's easy to delete and forget about it. But stop and think what just happened. You went to try to install one thing, and something else came along with it. Something you didn't choose to download and didn't even know you were installing it at the time. You didn't even know what it was. It latched onto something else that you trusted and came into your PC and got installed. I hate this kind of software. Software that you didn't install. It just came along for the ride. Software that you don't want on your machine. It has a hidden agenda, and who knows what that thing is doing there? This is a story about a piece of software that snuck onto our machines like that.

• 1:28Jack Rhysider?

  It's called Black Shades.

• 1:35Jack Rhysider?

  These are true stories from the dark side of the internet.

• 1:42Jack Rhysider?

  I'm Jack Resider. This is Darknet Diaries.

• 2:04Jack Rhysider?

  This episode is sponsored by ThreatLocker. The weird part about modern cyberattacks is how normal they look. The attacker logs in from Chrome, uses PowerShell, runs a remote admin tool your IT team already trusts. There's no custom malware, no dramatic movie hacker moment, just normal tools used in the wrong way. That's part of why ThreatLocker exists. ThreatLocker helps organizations control what software can run, what it can do, and how systems communicate. If attackers get credentials or land on a machine, they'll have a much harder time moving through the environment because security teams are realizing something important. Problem isn't always unknown software anymore. Sometimes it's trusted software being used by the wrong person. If you want to see how ThreatLocker works,

• 2:48Jack Rhysider?

  go to threatlocker.com/darknet and book a demo today. That's threatlocker.com/darknet to book a demo.

• 3:01Jack Rhysider?

  This episode is sponsored by Drata. Let's face it. If you're leading GRC at your organization, chances are you're drowning in a sea of spreadsheets every day. Balancing security, risk, and compliance in an ever-changing landscape of threats and regulatory frameworks can feel like running a never-ending marathon. Enter Drata's Agentic Trust Management Platform, designed for leaders like you. Drata automates the tedious tasks: security questionnaires, responses, continuous evidence collection, and much more, saving you hundreds of hours each year. With Drata, you can spend less time chasing documents and more time solving real security problems. With Drata, you also get access to a powerful trust center, a live customizable product that supports you in expediting your never-ending

• 3:44Jack Rhysider?

  security review requests in the deal process. It's perfect for sharing your security posture with stakeholders or potential customers, cutting down on the back-and-forth questions and building trust at every interaction. Ready to modernize your GRC program and take back your time? Visit drata.com/darknetdiaries to learn more. That's Drata, spelled D-R-A-T-A. Drata.com/darknetdiaries.

• 4:12Jack Rhysider?

  Let me start at the beginning. Alex Yusol and Michael Hoag created a program called Black Shades, and in 2010, they started selling it online. Black Shades, or more specifically, the Black Shades Rat, is a piece of software that allows an attacker to gain complete control remotely of a victim's machine. They can view their files, record their keystrokes, lock their data, and hijack their webcam. They marketed Black Shades like a regular software product. They had a website with an "About Us" page and an "Order Now" button. The page said, "Black Shades is mainly an IT surveillance and security-based company directed at making your PC experiences easier. Our main goal is to offer affordable software solutions comparable to bigger names out there."

• 4:56Jack Rhysider?

  Then they listed the benefits of using the product. To spy on your children or spouse. To find out if your partner is cheating on you. Or to see if someone was using your computer in unwanted ways. They even had a legal notice saying that it's legal to install monitoring software on your own computer, according to the Spy Act of 2004. And the price? Forty bucks. The site wasn't hidden on the dark web. It was right there in the open with normal-sounding marketing language. And at first glance, it doesn't look nefarious. But as you think about it, you're like, wait, hold on a minute. The software is used to spy on people? Which makes me wonder. Is Black Shades legal? Well, there's actually two questions here.

• 5:41Jack Rhysider?

  Is making and selling Black Shades legal? And is using Black Shades legal? The website says that this is a surveillance and security tool used to monitor the activity of your child's computer. Well, that in itself isn't illegal, even if it can be abused. Kind of like a knife isn't illegal. We need it to make food with. But someone waving it around on the street is suddenly a big threat. In fact, many businesses today use software just like that to monitor what their employees are doing. It'll take screenshots, record what apps are opened and in focus, and track the locations of devices. But when a company spies on its own computers, it typically makes it very clear. There is monitoring system on your computer. Or they make the employees sign a document which says you may be monitored while you're here at work,

• 6:25Jack Rhysider?

  which is what makes it legal. That person being spied on knows and consents to it. So on the surface, both making and using software like this can be perfectly legal. But Black Shades wasn't marketing this to businesses. They were marketing it on hacker forums. They specifically were building a tool that they knew people would use for malicious purposes. They weren't in the business of selling kitchen knives. They were specifically marketing their product to people they knew would abuse it. So their whole website, which was saying this is used to track your kids, that was really a lie. A ruse to make it look legal and look perfectly fine. And to the courts, who look at things through the lens of the law,

• 7:10Jack Rhysider?

  intent matters a lot. If you know you're selling to people who will use it to commit crimes with, then yeah, it's illegal to sell that. And when it comes to the customers, if they were putting it on people's computers without their consent and spying on someone without them knowing, then that's illegal too. That's unauthorized access to a computer. Privacy violations, identity theft, intercepting communications, and extortion. So yeah, this can be illegal to use as well. Both illegal to make and illegal to use. But again, it all comes down to intent of whether or not this is legal versus illegal. And if these people who use it, make it, are going to get in trouble over this, then the courts are going to have to prove that intent was there to sell it to criminals

• 7:55Jack Rhysider?

  or to spy on people without their permission. Black Shades is better known as the Black Shades Rat. And RAT stands for Remote Access Trojan. Remote access is like when you need computer help and IT support takes over your computer to fix something. Or when you log into your home computer from a coffee shop. A RAT is the exact same thing, except it's malicious in nature. Someone you don't know takes over your computer without your knowledge or consent, and they can see everything you're doing. And the scariest bit is you have no idea it's happening since it's completely running silently.

• 8:33Jack Rhysider?

  Once BlackShades is on your machine, the attacker has an astonishing level of access. They can read every file and view every photo and video on your computer. They could see every single key you pressed, every password, every credit card number, every private message went straight to the attacker. They could steal the logins to your bank, your email, your social media accounts. They could turn your webcam and microphone on. And from there, they can commit a litany of crimes: theft, extortion, blackmail, for example, but also wire fraud and identity theft. And it gets worse. BlackShades had a feature called "The Spreader." Once it was on your computer, the attacker could use your social media accounts and chat apps to try to spread it to your friends' computers too. They could even use BlackShades for ransomware, locking up their target's files

• 9:17Jack Rhysider?

  and demanding payments to unscramble them. I can't imagine this feature being used for any legitimate purpose. So the fact that this had a ransomware feature squarely puts it in the malicious software territory, if you're asking me, making it clearly illegal. But BlackShades would make their users click on a button stating that the user is responsible for whatever the action resulted in, and warning them to be careful when using this feature. And it also said, "This was made for educational purposes only." Yeah, okay, sure. But there was one problem for BlackShades users. You couldn't just wave a wand at someone and infect their computer with BlackShades. And no one in their right mind would install this

• 10:01Jack Rhysider?

  to give some random attacker full access to their computer. So to get BlackShades on a victim's machine, you had to trick the victim into installing it themselves, to make them think they're installing something else. And that's tricky, because you basically have to exploit another human to get it installed, which brings us into the world of social engineering, the art of tricking people into doing things they don't actually want to do. There are a thousand and one ways that we can all be tricked into installing things that we don't actually want. Humans are a weak link when it comes to computer security. And you might have seen some of them obvious links. Click here for a free iPhone. And you're like, "Yeah, nah, I'm not doing that." But sometimes, it's not so obvious. Since BlackShades can spread

• 10:44Jack Rhysider?

  from a friend's computer to yours using malicious links, it can look like it's coming from someone you trust. They can also hide malware inside pirated software, games, or movies on peer-to-peer file sharing sites. So if you downloaded a cracked version of a video game that you didn't want to buy, BlackShades might come along for the ride and get installed with it. And I should know too. When I was a teenager, I downloaded a lot of shady apps and games from shady parts of the internet, and I would constantly be dealing with infections. I didn't care, because I really wanted to play the game. But eventually, these infections would get so bad that I couldn't use my computer at all. Pop-ups would just constantly be showing up. The CPU would crawl to a standstill. I must have been hit with malware hundreds of times when I was a teenager. But that's what got me good at fixing computers:

• 11:29Jack Rhysider?

  learning how to find malware and remove it and cleaning up my computer. After a while, I took pride in knowing there is no problem that I can't fix on my computer. Worst case is I could just reinstall the operating system if I had to, which I did a lot. I mean, a lot, a lot. Anyway, sometimes, devices you buy in the store actually come with malware on them. There was a story I read once where a Chinese laptop maker was selling their laptops at Amazon that came with Windows 11. Well, the thing was, the Chinese seller was trying to cut costs and didn't want to pay for Windows 11 license keys for every computer. So they found a pirated version of Windows, installed that, and shipped it with their laptops. Little did they know, the pirated version contained malware and was draining people's crypto wallets and robbing their Steam accounts. So you need to be really careful with what apps you install

• 12:15Jack Rhysider?

  and where you get them from, because having one bad app on your computer can ruin you. But even apps you vet thoroughly can turn rogue. I've seen some popular browser extensions get purchased by someone who had malicious intent. And then they put spyware on people's browsers without them knowing. Or maybe someone makes a simple mobile app that's clean and fine and free even. But as it grows in popularity, there's always someone that asks them, "Hey, I'll give you a few thousand dollars if you can put this widget in your app. Don't worry, it's just an advertising pixel." And if someone's making free software and suddenly get offered a few thousand dollars to add a simple advertising pixel, they might say yes. Now, suddenly, that app, which was clean and good, now has some malicious code in it,

• 12:59Jack Rhysider?

  tracking what you're doing on your phone. Stuff can sneak into our devices from all kinds of directions. It's a war out there. Then there's USB sticks. If you put a USB stick into a computer, Windows will look at it and see if there's a file called autorun inf. And if so, it'll run the commands in that file. So if someone swings by your computer, pops a USB stick in the slot, it may auto-infect that machine. And then you could just pull the USB stick out, and nobody knows what happened. Back in the days of Windows XP and Vista, this feature was on by default in Windows. Nowadays, the autorun feature is not on by default, thank goodness. But this was a popular way people would infect computers with BlackShades, since it was just dead simple to do. Just stick the USB stick in for a few seconds and pull it out, and you're done.

• 13:44Jack Rhysider?

  I think the most popular way people were getting victims to install this is to send them a message saying, "Oh my God, is this you? How embarrassing," with a link to a photo or a video. Except it wasn't a photo or video. It looked like it, but when you tried to open it, it was really a program that would install BlackShades. Another one, which I actually seen in my own inbox, is something like, "We've tried to deliver a package to you three times now. We were unsuccessful. We're gonna send it back to the shipper unless you click here." And I always have this knee-jerk reaction, like, "Oh, man, I don't want my package returned." And then I realize it's to an email I've never used for ordering things before. And I'm like, "Oh, that's a scam. They're trying to trick me." So no matter how vigilant you are,

• 14:29Jack Rhysider?

  I think we're all susceptible to phishing emails. Just has to be clever enough to make you click. Once BlackShades got installed on a victim's computer, the operator needed no skill at all. You didn't even have to open a terminal. It came with a slick little dashboard to show you every computer that you've infected, with icons telling you if there is a camera available on that computer or not. If you were the operator, you could simply point and click on the computer you wanted to see. And now you could see their desktop, files, and yeah, camera. I mean, you could see it all: people's private messages, social media accounts, Google searches. It was spooky. There was this guy named Stephane Rigaud from Leeds in the UK who saw what BlackShades could do, and he became interested.

• 15:14Jack Rhysider?

  He was 34 years old. He bought it for 40 bucks using his ex-girlfriend's credit card. And then, he infected his ex-girlfriend with this malware. Maybe he sent her a phishing chat message or plugged in a USB stick when he visited her house one day and she left the room or something. But when he was at his computer, he could see when her computer was online. Her computer had a camera on it. And from the dark comfort of his own house, he turned on her camera and watched her in her bedroom. He found it incredibly addicting. She had no idea he was watching her. Usually, there's a little light that comes on when your camera's on, right? Well, BlackShades made sure that light didn't come on.

• 15:58Jack Rhysider?

  Watching her in her bedroom gave him a rush. He liked it. He had some other lady friends and wondered what they were doing too. So he started infecting more and more women that he knew with BlackShades. He could hear conversations people were having. He watched them get undressed. Of course, he's taken screenshots of them changing and saving the recordings. He liked that kind of stuff the most. And Stephane got seriously addicted to watching what women do in the privacy of their own homes. Every day, he would open up his BlackShades dashboard and look to see what computers he infected were online. And then he'd double-click on one and sit there, watching what they were doing. Not only was he watching through the cameras, when they'd use their computers, he'd watch what they were doing on air too. He could see their passwords,

• 16:43Jack Rhysider?

  their private messages with people, their photos, what they bought online, their online banking activity, everything they did on that computer. And the thing that made it addicting to him is that he never knew when something interesting would happen or what would happen. To him, it was like a wave of excitement when he actually saw someone changing in front of a camera. That would make it all worth the time to him. He started out by putting it on the computers of women he knew. But then, he learned how to spread it from those computers to their friends' computers. And now, he was infecting other women that he didn't even know. And he didn't stop there. He was trying to infect other women too, like people working in coffee shops or at a library. It was real easy for him

• 17:27Jack Rhysider?

  just to put in a USB drive and try to infect someone's laptop. He was seriously addicted to this. And over time, he got over a dozen people infected with BlackShades. And with that, there was always someone online doing something interesting that he liked watching.

• 17:45Jack Rhysider?

  There's a whole voyeurism fetish out there on the internet. People will secretly film women getting undressed and posting it online. Or maybe they'll hold a camera under some lady's skirt and take a photo of that and share it. Well, this voyeurism community was hearing about what you could do with Black Shades, and they were into it. The Black Shades rat had incredible potential for secretly getting videos of women undressing or having sex. Soon, the biggest user base of Black Shades were guys spying on girls to see them naked. And in most cases, the guys were spying on the girls they knew, keeping tabs on exes, getting dirt on someone they're jealous of, or just spying on women because they found it fascinating. Over time, thousands of Black Shades users were using this tool to spy on women.

• 18:30Jack Rhysider?

  It really helped Black Shades grow in popularity. But they weren't the only people interested in Black Shades. It was also used to target activists. In 2012, Syria was in the middle of a civil war. People were really upset with the president of Syria, Bashar al-Assad, for using chemical weapons on his own civilians. The country ignited in large-scale protests and pro-democracy rallies as part of the Arab Spring. In the midst of this, researchers at the Electronic Frontier Foundation and the Citizen Lab noticed that Syrian activists were getting hit with malware. They would get a link from a Skype account from someone they knew and trusted without realizing that account was compromised. One message read, "There's a person who hates you, and he keeps talking about you. Here's a screenshot of the conversation."

• 19:13Jack Rhysider?

  And there was a link to the malicious file. And when they'd click it, Black Shades would install itself on their device. The Syrian government used Black Shades to spy on opposition activists and tried to suppress them by having total control of their computers. They could do things like get information on the next rally, or delete social media accounts, or look through photos and documents. Before Black Shades, there was another tool called Dark Comet. It was developed back in 2008 by a French programmer named Jean-Pierre Lassour, also known as Dark Coder SC. He discontinued the program, partially due to its use in the Syrian civil war and possibly due to the fear of him being arrested. Like Black Shades, Dark Comet was used to spy on victims through keylogging, screen captures, and by stealing their passwords.

• 19:58Jack Rhysider?

  And to me, this is really fascinating because, at the time, a lot of activists within the hacker group Anonymous were very active in the Arab Spring, trying to help the protesters from afar by knocking the government offline and doing stuff like that. And it's wild that the very people who wanted to assist the protesters are also the ones who are accidentally assisting the government to suppress the protesters. Because tools are typically neutral and can be used by either side. And when you make something so effective, people will notice it on both sides and use it for their own agenda. I don't have any knowledge of whether the creators of Dark Comet or Black Shades were members of Anonymous. And it wouldn't surprise me if they were because, well, at least the maker of Dark Comet said some stuff online that looked a lot like what the Anonymous activists were saying about Syria at the time.

• 20:43Jack Rhysider?

  So this was yet another thing this malware was being used for. A $40 piece of software marketed to suspicious spouses and parents was being used to find dissidents during a war. Which, by the way, government intelligence units love using off-the-shelf tools to conduct their spying, since they don't have to burn any of their trade craft to conduct their tasks. A $40 off-the-shelf tool is way cheaper than spending a lot of time and energy developing their own tool to do the same thing. By this time, Black Shades was becoming well-known in the hacker communities. Hundreds of people were buying it and infecting thousands of machines with it, which also meant the victims were waking up to the nightmare happening to their computers. Victims would often get extortion emails, or they would receive an embarrassing photo of them with some kind of demand.

• 21:28Jack Rhysider?

  The obvious demand is to pay some Bitcoin, and we'll delete it. But some were downright evil. Like, people would send a half-naked photo to their victim and say, "Send me a fully nude photo, or I'm posting this on your own social media account. Let me show you that I have access to it." And then they would post a test message to prove it. It would rattle a lot of these women. And they would sometimes send the pictures that were demanded, simply out of fear. Sometimes the attacker would catch a picture of their victim having sex, and send them a picture of that and demand a video call over Skype. And they'd ask the woman to do, like, a five-minute sex show for them on camera as part of the ransom demand. And if they didn't do it, the attacker had access to all their social media accounts

• 22:14Jack Rhysider?

  and said they'd post something really terrible if they didn't do it. Black Shades was a growing problem, and victims were being almost entirely silent about the matter due to all the embarrassment and fear. And I hate to say it, but it's possible that some women died by suicide because of this. I haven't seen any specific stories about that happening with Black Shades, but I've seen countless stories where online bullying and abuse and harassment has led to women feeling so desperate that they'd rather die than face the embarrassment or harassment anymore. It's really tragic. We're gonna take a quick ad break, but stay with us because this is where the FBI starts to get involved.

• 23:01Jack Rhysider?

  This episode is sponsored by Ramp. Most companies are already spending more on AI than they realize. AI token spend is growing faster than any other category of business spend, and most businesses can't see where it's going. Ramp is the financial operations platform used by more than 70,000 businesses to manage and control spend. Now Ramp is bringing the same visibility and control to AI. With Ramp, you can spend across AI providers and set real-time controls and guardrails by team and model. Ramp isn't incentivized to get you to spend more on AI. Instead, Ramp works with you to ensure your AI spend is going to the highest ROI areas. When I worked as a network security engineer, I would have begged my finance operator to use Ramp because it's so good.

• 23:43Jack Rhysider?

  Stop guessing where your AI spend is going and get started with Ramp today. And if you're new to Ramp, you can get $250 off at ramp.com/darknet. Go to ramp.com/darknet. That's ramp.com/darknet.

• 24:02Jack Rhysider?

  The FBI started rooting around in some hacker forums, looking for crime. But they weren't focused on this, not yet at least. They were focused on stuff like credit card fraud and online fraud. In 2010, the FBI decided to go on the dark web and build their own stolen credit card exchange. They were hoping thieves would come and sell stolen cards, and people would buy them, and then the FBI would catch them in the act. And it's wild to me that the FBI built their own Carter's Market on the dark web, a honeypot to trap people. Not only could you buy and sell stolen credit cards there, but they sold tools for stealing credit cards too. However, dark web forums like this only work when there's trust.

• 24:45Jack Rhysider?

  So the FBI, which was acting like dark web operators, said they'll verify every tool before it's allowed to be sold on this site. So for instance, if you wanted to sell a credit card scraper, the FBI would have to vet you as a seller first. Send us one, and we'll test it, and if it's good, we'll approve you as a vendor. The administrators were either undercover agents or confidential sources in the investigation. They were reviewing these products to get evidence of criminal activity and to investigate the hardware, software, and methods used. The FBI was looking for credit card fraud. But then, the co-creator of Black Shades, Michael Hoag, wanted to become a vendor on this forum. So he submitted his tool, Black Shades,

• 25:29Jack Rhysider?

  to show them that he has a real tool that can be used to scrape credit card data. He had no idea he was pitching the FBI. And it's kind of ironic that the co-creator of Black Shades fell for a social engineering trap himself. See, even he's susceptible to that. The FBI couldn't believe Michael sent them his malware. This was clear evidence of his intent, to sell Black Shades to criminals? All that language, that this was only for educational purposes or for a parent to monitor their kid, wasn't gonna fly anymore. When you're selling it to criminals on a dark web forum to steal credit card data with, then that's clear intent. In 2012, the trap snapped shut.

• 26:12Jack Rhysider?

  The FBI ran a sting operation called Operation Card Shop. It led to 24 arrests in eight countries. Almost all of these arrests were for credit card fraud, but there was one exception. One of the people arrested was Michael Hoag, the maker of Black Shades. He was charged under the Computer Fraud and Abuse Act for conspiracy to commit computer hacking and transmission of malware. Writing and selling software isn't illegal, but writing and selling software with the intent of logging keystrokes, ransom-wearing files, stealing credit cards, and spying on webcams without consent is illegal. Hoag cooperated with investigators, which meant he avoided prison entirely. He was sentenced to five years of probation.

• 26:56Jack Rhysider?

  He was ordered to forfeit $40,000 and had to perform 500 hours of community service. So that's it, right? Co-creator of Black Shades arrested, two dozen people in cuffs, game over for Black Shades at least, right? Except it wasn't. The Black Shades website stayed up and operational and kept selling it to people for 40 bucks. And what's hilarious is around that time, Black Shades became so popular that you could find pirated versions of it floating around too. People who didn't want to pay the $40 could download it and install a pirated version and use it. And it's hilarious because almost certainly, a pirated version of Black Shades is going to come with some other malware bundled on it.

• 27:37Jack Rhysider?

  You're gonna get some other spy tool installed if you install this. People were spying on the spies. Over the next year, Black Shades did not shrink, it grew. In 2013, Black Shades made its news again.

• 27:52Speaker 01

  Miss Teen USA 2013 Cassidy Wolf was one of the victims of a hacker using the malicious software called Black Shades Rat or Remote Access Tool. Authorities say last year, a hacker used Wolf's personal computer webcam to take nude photos of her and threatened to post them online if Wolf didn't send him more revealing photos. Instead, she went to police.

• 28:15Jack Rhysider?

  Cassidy Wolf, a high school student from Temecula, California, got an anonymous email. The stranger said he had photos of her, photos taken in her bedroom through her webcam on her own computer after he hacked into it. He tried to extort her after threatening to release intimate photos unless she provided him with a special performance. Classic extortion.

• 28:39Jack Rhysider?

  She had no idea she was infected by this. She said her camera light never came on and she didn't know anybody had been staring at her in her room this whole time or watching her computer. She didn't send any photos to this stranger. She went to law enforcement instead. The FBI ran the investigation and when they figured out who was behind it, it turned out the hacker wasn't some shadowy figure on the far side of the world. It was a guy she went to high school with, a former classmate named Jared Abrahams. And she was not the only one. Jared used Black Shades to break into the computers of at least two dozen women and girls. Their ages ranged from 16 to their early twenties. Jared got arrested by the FBI.

• 29:22Jack Rhysider?

  Two months later, he pled guilty to extortion and hacking. He went to court for sentencing and he was sentenced to 18 months in federal prison. Four months after this extortion attempt, Cassidy Wolf was crowned Miss Teen USA 2013. And instead of keeping quiet about what happened to her, she did the opposite. She spent her year using that title to go to schools and talk about exactly that: webcam hacking and extortion.

• 29:51Speaker 02

  Yeah, so a few years ago, I was with a friend of mine and I randomly got an email. And in that email, he had attached photos that he had taken of me through my webcam. So it ended up being a federal investigation for three months straight. The guy that did it ended up going to prison for 18 months.

• 30:10Jack Rhysider?

  Wow, how brave of her to use her newfound popularity to fight for justice and to win. So that's one guy caught for spying on girls. But that didn't slow down the continual growth of Black Shades' sale and usage. Because by May 2014, Black Shades was booming. By then, it had infected over a million computers worldwide. And when the FBI arrested Black Shades co-creator Michael Hoag, he became a cooperating witness, which meant he let them see all the inside baseball of his organization. He showed the FBI how many computers it had infected, who the users were, everything. Well, actually, I don't know how much he actually showed them versus how much they saw because they just seized all his servers and took all the computers for themselves.

• 30:53Jack Rhysider?

  So the FBI knew the malware had infected over 500,000 computers in over 100 countries and had generated over $350,000 in sales. They had the names and addresses of more than 6,000 customer accounts. Basically, a customer list of all the people around the world who bought Black Shades. And they shared this list with law enforcement partners around the world. So what do you do as the FBI when you have the billing information for thousands of Black Shades customers? I know you've heard the term before, "They can't arrest us all." But can they? I think they wanted to. But the FBI has a 99% conviction rate. If they arrest someone, they better have bulletproof evidence that that person committed a crime. I mean, that one user, Stefan, bought the thing using his ex-girlfriend's credit card, right?

• 31:38Jack Rhysider?

  So just a list of names of people who purchased it isn't enough. They need to go through each customer individually and prove that they were actually abusing the tool. Because what if someone was just using it to monitor their child's computer activity, like the website advertised it? They didn't want to make any mistakes. So they spent months and an enormous amount of time building cases for as many of its users as they could. And they were able to get enough evidence on lots of people who were clearly abusing the tool. But those people were located all over the world. So they reached out to law enforcement in 18 different countries to try to do a worldwide, coordinated takedown. And on May 19, 2014, law enforcement officials from around the world raided the homes of

• 32:22Jack Rhysider?

  Black Shade users, arresting as many people as they could. Here's Preet Bharara, the US Attorney for the Southern District of New York, in a press conference explaining what they did.

• 32:32Speaker 03

  We are announcing another global law enforcement operation that has exposed and crippled a frightening form of cybercrime affecting hundreds of thousands of computer users around the world.

• 32:45Jack Rhysider?

  The operation led to 97 arrests and 359 searches across the world, with people detained in the US, the UK, Germany, France, the Netherlands, Belgium, Austria, Switzerland, Italy, Croatia, Denmark, Estonia, Finland, Moldova, Canada, and Chile. The age of the criminals varied. Some were teenagers, a 16-year-old in the UK, a 17-year-old in Finland, and 18-year-olds in the Netherlands. Others were adults, and I'm pretty sure it was all males who got arrested. 97 people arrested for using the tool. The reasons for using it varied, too. Some used it for voyeurism and extortion. Some used it for financial theft. Some built botnets to launch DDoS attacks. Some locked computers up with ransomware.

• 33:28Jack Rhysider?

  More than 1,000 data storage devices were also seized, and they took the Black Shades website offline. One case involved an 18-year-old man from the Netherlands who allegedly infected 2,000 computers to take photos of women and girls who were using their machines. 2,000 infections from one guy alone. In 2014, prosecutors in the US unsealed charges against five people. Here's FBI's Special Agent in Charge Leo Taddeo.

• 33:57Speaker 03

  We have charged three key members of the Black Shades organization, as well as two cybercriminals in the New York area who purchased the software and used it to victimize hundreds of innocent people. Specifically, we announced charges against the two alleged creators of the Black Shades rat, Alex Usel and Michael Hoag. Usel, a Swedish citizen, was arrested in Moldova in November 2013, and he is awaiting extradition to the United States. The indictment against Usel has been under seal and was made public earlier today. Mr. Hoag was arrested in Arizona in June of 2012 and subsequently pled guilty in January of 2013.

• 34:38Speaker 03

  Mr. Hoag has been cooperating with the government in its investigation since his arrest. We have also charged and arrested today Brendan Johnston, a former Black Shades employee who helped market and sell the rat, as well as provide technical assistance to its users, and two New York area purchasers of the rat who allegedly used it to steal online account information and spy on victims through webcams.

• 35:05Jack Rhysider?

  When the FBI made copies of the customer list, they didn't stop at the developers. Across more than 40 US cities, agents knocked on the doors of regular people who'd paid 40 bucks. And if you were on hacking forums at the time, you would have seen panic unfold in real time. People were posting things like, "The FBI just raided my house," or "They took my computer," or "What do I do?" One guy in Canada posted that the police showed up with a warrant because his son had bought it.

• 35:32Speaker 04

  During this past week, FBI agents in over 40 cities across the country conducted searches, interviews, and arrests of people who purchased Black Shades and may have used it to commit cybercrimes. We also passed leads to foreign law enforcement agencies around the world. In the last few days, our law enforcement partners in 19 foreign countries carried out their own law enforcement actions. The combined efforts of the FBI and foreign law enforcement marks the Black Shades takedown as one of the largest global cyber operations in history.

• 36:06Jack Rhysider?

  Wow, one of the largest global cyber operations in history. And remember that guy I told you about earlier, Stefan Riggo, who infected over a dozen women with Black Shades? He was arrested in this operation, too, and he pleaded guilty. He received a suspended sentence, 200 hours of community service, and seven years on the sex offender registry.

• 36:27Speaker 04

  Combating cybercrime is a top priority for the FBI. The charges unsealed today should put cybercriminals around the world on notice. If you think you can hide behind your computer screen, think again. Just like in the physical world, the FBI will follow the digital trail to your doorstep. If you think operating in a foreign country puts you out of our reach, think again. We have many law enforcement partners around the world who are with us in this fight. If we can't reach you, they can.

• 37:01Jack Rhysider?

  Black Shades is old now. Most antivirus software can detect it, and some of the methods it used to spread no longer work. The website is gone, the forums are dead, the people who built it got arrested. But even though Black Shades today is mostly a museum piece, malware doesn't really die. It evolves. The $40 rat with the friendly menu got replaced by newer ones with different names. The criminal economy moved into newer, more sophisticated malware that's harder to detect. And what's still true is malware wants to be sneaky and live quietly. It doesn't want the victim to know they are infected. And there's an asymmetry of knowledge here, which is a huge gap, actually. Most people don't know enough about computers or how to secure them to protect themselves reliably.

• 37:45Jack Rhysider?

  And these attackers rely on that lack of knowledge to hide in the wires, under the radar. Listening to shows like this starts to bridge that gap. Now, you're aware that tools like this exist in the world, and they're a big deal. I mean, this one resulted in one of the largest global cyber operations in history. This isn't just some little thing. This is a huge problem. So awareness is step number one for your safety. Be aware that messages from friends can contain malware, and it doesn't always mean that they sent it to you. It's always good to verify things out of band if you're not sure. Like, if you get a text message from a friend with a suspicious link, call them on the phone and be like, "Hey, did you just send me this text?" It's always better to be safe than sorry.

• 38:29Jack Rhysider?

  Be aware that all of the documents that you have, the photos you took, or anything you've saved on the cloud, may and probably will get loose at some point and get out in the world. Data breaches are extremely common, and malware like this makes it easy for an attacker to get into your computer to see your stuff. So treat your sensitive documents and photos with much more care than normal. For me, I store stuff offline, on a hard drive that's encrypted. It's a pain in the neck to interact with those files on there, but that's the point. I want to make it really hard for anyone else to access it, too. And there are also USB sticks that you can get, which encrypt all the data on it, and to decrypt it, you have to enter in a PIN code.

• 39:14Jack Rhysider?

  And storing stuff on an encrypted USB stick is a pretty good idea, especially since things like mobile phones can't decrypt a hard drive to interact with it. You should treat the internet as a hostile place, because it is. Be very, very cautious when downloading things, clicking links, installing stuff, accepting pop-up options. For me personally, I try to adopt a very minimal approach when it comes to the software and apps I use. The fewer, the better, because it reduces the attack surfaces for things that can go wrong. And for Pete's sake, cover your cameras. I think a lot of us are already in the habit of covering our laptop cameras, which is great. But what about your phone camera? I'm seeing cases these days. I have a little slider on the back of the phone, so it covers the camera, and I love that. I have one of those myself. But what about the front camera?

• 39:58Jack Rhysider?

  I haven't seen any cases that cover that. There are little camera covers that you could stick on it, but in my experience, they just always pop off after a few days. I've actually experienced with a ton of different types of tape. Electrical tape is easy to peel off for a photo, and it doesn't leave much residue. But you need to swap the tape out every month or so, or else it gets gooey. I just don't trust cameras to be off when I think they're off because of stories like this. I also unplug the TV when I go into hotel rooms when I stay there, since a lot of them have cameras and mics in them, too. Of course, you should keep your system and apps updated. Use a different, complex password for every service app and website you have an account for. Actually, I use a different email address for every account that I have as well. This way, I immediately know if something doesn't look right,

• 40:41Jack Rhysider?

  because it'll be for an email that I only use for one thing, and now I'm getting something else from it. It's not a bad idea to use an antivirus scan every now and then to check for malware on your devices. And I'm not going to plug any here, though, but do some research and find one that's trusted and reputable. I'm not sure we can achieve perfect privacy or security, but like I've said before, when you're trying to secure your stuff, it's kind of like running from a bear in the woods. You don't need to be faster than the bear. You just need to be faster than your friend, who's also running from the bear, in order to stay alive. Your goal is to make it hard for an attacker to get to your stuff so that they just move on to an easier target.

• 41:28Jack Rhysider?

  This show is created by me, Papa Ransom, Jack Recider. This one was written by Motherboard, Yale Grauer. Our editor is the Gigabyteer, Tristan Ledger. Sound design by the LFO, Garrett Tiedemann. Mixing by Proximity Sound, and our intro music is by the mysterious Breakmaster Cylinder. If you haven't checked it out already, you should go listen to my other podcast called Lo. It's the craziest story I've ever told. It's the craziest story I've ever heard, and it just might change the way you think about life. Go find Lo wherever you listen to podcasts, spelled L-O-W. My computer just went through a messy divorce. She ended up getting the C drive, and he got the D drive. This is Darknet Diaries.