Overview of Darknet Diaries Episode 182: Blackshades
This episode tells the story of BlackShades RAT, a cheap remote-access trojan sold like legitimate software but widely used for webcam spying, credential theft, extortion, and ransomware. Jack Rhysider traces how a $40 tool marketed as “surveillance software” spread through phishing, pirated downloads, USB autorun tricks, and social engineering, eventually drawing the attention of the FBI and law enforcement agencies worldwide.
What BlackShades Was
A “legit-looking” spyware product
- Created by Alex Usil and Michael Hogue and sold publicly starting around 2010.
- Marketed with normal business-style language, an “About Us” page, and an “Order Now” button.
- Claimed to be for monitoring children or employees, but was heavily used for abuse.
What it could do
BlackShades gave attackers remote control over infected computers, including:
- Viewing files and photos
- Logging keystrokes and stealing passwords
- Accessing webcams and microphones
- Capturing screenshots
- Spreading itself through social accounts and chat apps
- Locking files for ransomware-style extortion
How It Spread
Social engineering was the main delivery method
Victims typically had to be tricked into installing it themselves:
- Fake photos/videos sent through messages
- Phishing emails about packages or embarrassing content
- Malicious links from compromised friends’ accounts
- Pirated software, games, and movies
- Bundled installs on shady downloads
- USB stick autorun infections in older versions of Windows
Why it worked
- The payload often arrived disguised as something trusted.
- Victims usually had no idea they were installing malware.
- Once installed, it ran quietly and invisibly.
Who Used It and Why
Voyeurism and sextortion
A major group of users were men spying on women:
- Watching webcams without consent
- Recording intimate moments
- Blackmailing victims with screenshots or nude images
- Forcing victims into sexual demands or video calls
A notable example was Stefan Rigo in the UK, who used BlackShades to spy on women he knew and became addicted to watching them through their webcams.
Political repression
BlackShades was also used against activists:
- In Syria, it was used to spy on opposition figures during the civil war.
- Researchers from EFF and Citizen Lab documented attacks where activists were lured into opening malicious files.
- The episode connects this to the broader use of off-the-shelf malware by governments because it is cheap and effective.
FBI Investigation and Takedown
How the FBI got involved
- The FBI was already running a sting operation against credit-card fraud called Operation Card Shop.
- Michael Hogue tried to sell BlackShades on the FBI’s undercover forum, unintentionally proving criminal intent.
Legal outcome
- Hogue cooperated with investigators and avoided prison, receiving:
- 5 years probation
- $40,000 forfeiture
- 500 hours of community service
- Usil and other associates were also charged.
Global crackdown in 2014
- Law enforcement in 18+ countries coordinated raids.
- 97 arrests and 359 searches were carried out worldwide.
- The FBI seized data and customer records, helping identify thousands of users.
- BlackShades was taken offline, though pirated copies continued circulating for a while.
Notable Case: Cassidy Wolf
- Cassidy Wolf, Miss Teen USA 2013, was one of BlackShades’ victims.
- A former high school classmate, Jared Abrahams, used the malware to spy on her webcam and extort her.
- He was arrested and later sentenced to 18 months in federal prison.
- Wolf turned the incident into a platform for speaking about sextortion and webcam hacking.
Main Takeaways
Malware is often hidden in “normal” places
- Trusted friends, common downloads, and legitimate-looking software can all be vectors.
- A malicious message doesn’t always mean the sender intended harm; their account may have been compromised.
Intent matters legally
- Surveillance software can be legal in some contexts.
- Selling a tool specifically to criminals or for spying without consent can make it illegal.
Security is partly about making yourself a harder target
- No one can be perfectly secure, but you can reduce risk significantly.
Security Advice from the Episode
- Verify suspicious messages out of band before clicking links.
- Keep systems and apps updated.
- Use strong, unique passwords for every service.
- Consider encrypted storage for sensitive files.
- Be cautious with downloads, USB drives, and browser extensions.
- Cover cameras on laptops and phones when not in use.
- Use reputable antivirus/anti-malware tools.
- Reduce your attack surface by using fewer apps and services when possible.
Closing Message
The episode frames BlackShades as a cautionary tale about how ordinary-looking software can become a powerful abuse tool. Even after the takedowns, the broader lesson remains: malware evolves, attackers exploit trust, and awareness is one of the most important defenses.