150: mobman 2

0:00I remember the first time I posted something online. It was a video game guide in the 90s. And there's an internet adage that I think is true. It goes like this. The best way to get the right answer on the internet is not to ask a question, but to post the wrong answer. I posted a guide on how to beat a video game, and it immediately got downvoted, mocked, ridiculed, and I was told to get good. At first, I thought they were joking. Like, I've beaten this game 100 times with this strategy. What are you talking about? Get good. But then after some pushback, they started cluing me in, telling me exactly where my advice was wrong and giving me tips on how to properly do those parts of the game.

0:40I was blown away. What I thought was impossible to do in the game, people were actually doing. Now, dear listener, this experience shaped me for who I am today. If you post something genuinely helpful online and people mock you, that could be the end of you ever posting anything online again. It's enough to ruin your self-confidence and hate everyone online. But I had the opposite reaction. I loved this game and played it thousands of times. They were giving me tips and strategies on how to be way better than my best strategy that I had. And I genuinely wanted to be way better. Not only that, I got to make friends with other people who were really passionate about this game.

1:21It was an amazing experience. Fast forward to today. We're 150 episodes into this podcast. That's 134 hours of me yapping. I've got a lot of feedback over the years. Most of it is positive. But today, today I've got to correct something I got wrong. Really wrong.

1:46These are true stories from the dark side of the internet.

1:53I'm Jack Recider. This is Darknet Diaries.

2:14This episode is sponsored by Delete Me. Right now, the headlines are chock full of data breaches and regulatory rollbacks, making us all vulnerable. But you can do something about it. Delete Me is here to make it easy, quick and safe to remove your personal data online. Want an easier way to deal with data breaches? Get DeleteMe. The fact is we're all at risk. How many times have you gotten an email or letter saying your data has been breached? It's unsettling. But the good news is DeleteMe can help. Once you've signed up for DeleteMe, they won't stop. It constantly monitors and removes your personal information that you don't want to have on the internet.

2:46Privacy is a super important topic for me. So a few years ago, I signed up and DeleteMe immediately got busy scouring the internet for my name and gave me reports on what they found. And then they got busy deleting things. it's great to have someone on my team when it comes to my privacy. Take control of your data and keep your private life private by signing up for Delete Me. Now at a special discount for my listeners, get 20 % off your Delete Me plan when you go to joindeleteme.com slash darknetdiaries and use promo code DD20 at checkout. The only way to get 20 % off is to go to joindeleteme.com slash darknetdiaries and enter code DD20 at checkout.

3:26That's joindeleteme.com slash darknetdiaries, code DD20.

3:56or a letter saying your data has been breached, it's unsettling. But the good news is DeleteMe can help. Once you've signed up for DeleteMe, they won't stop. It constantly monitors and removes your personal information that you don't want to have on the internet. Privacy is a super important topic for me. So a few years ago, I signed up and DeleteMe immediately got busy scouring the internet for my name and gave me reports on what they found. And then they got busy deleting things. It's great to have someone on my team when it comes to my privacy. Take control of your data and keep your private life private by signing up for Delete Me.

4:26Now at a special discount for my listeners, get 20 % off your Delete Me plan when you go to joindeleteme.com slash darknetdiaries and use promo code DD20 at checkout. The only way to get 20 % off is to go to joindeleteme.com slash darknetdiaries and enter code DD20 at checkout. That's joindeleteme.com slash darknetdiaries code DD20. Over the years, one episode I've published has haunted me. Episode 20 called Mob Man. Take a listen to this short clip of it. I made this up seven. It's a remote access tool and it was a Trojan horse virus. He built a program that would allow him to take control of another computer.

5:13You could open and close the CD wrong. You could flip the screen. You could hide the start button. You could move the mouse on their screen and click around. You could open up their C drive, change their wallpaper. This is an episode where I interviewed a guy named Greg, who went by the name Mob Man, who claimed to have made the Sub7 malware back in the 90s. The episode haunts me because I have received numerous comments that listeners don't believe he's the guy who created Sub7. For instance, there's a Reddit post where someone said, I just started listening to Mob Man this afternoon and couldn't finish it.

5:52I just don't believe this guy made Sub-7 or could have created a rat at all. It's not just his attitude or personality. It just seems as if he only has a cursory knowledge of any of the technology used. Multiple times throughout the interview, something he said just didn't quite make sense or didn't match up with what I remember from that time period. Then some other commenter said, I had the same impression too. And someone else said, he's fakey-wakey. And then someone else said, I remember the creator was Romanian, and that guy is not Romanian. I fact-check my guests as best I can. But I do most of the research and writing for this show, and I can only check so much.

6:29Before publishing that episode, I spoke to some people who knew Greg personally from Tampa, where he's from. And they told me he's legit. On top of that, he was featured in a Rolling Stone magazine article saying he's the one who created Sub7. I figured Rolling Stone would do some fact-checking themselves, right? And also, Greg offered to show me the source code for Sub7, and he demonstrated how he has control over the Sub7 domain name. So I'd just show this to people who didn't buy the story. But as I listened to people and read more theories about this, it started to make me think, maybe they're right.

7:00Maybe I interviewed the wrong person. See, I interviewed a guy named Greg, who goes by Mob Man, and on every version of Sub7, it was created by someone calling themselves Mob Man. So I'm starting to think, wait, if Greg didn't make Sub-7, then are there two mob men out there? If so, where's the second one? Somewhere around 2004, the Sub-7 creator, Mob Man, disappeared. And Greg just so happened to get arrested the same time too. And so he says, that's why he disappeared. So did two mob men disappear at the same time? If there are two, then Greg is the only one who came back as Mob Man. The other mob man is still out there somewhere Well, a guy named Ill Will Took it upon himself to find the real mob man And he spent years hunting through the internet Looking for him And eventually found a clue Which led him to a potential email address Used by the real mob man He emailed him And sure enough, he said Yeah, I'm the one who created Sub7 You found me And I got connected with this mob man To hear the story Hello, hello.

8:10Hi. Very punctual. Read a 12 on the dot. Yeah, why not? Now, you have the tag here, Mob Man, here in our call. I do. Is that your nickname? Yes. When did you start using that? 1999, I want to say. And what is the meaning of it? It comes from a rap band, a Romanian rap band called BUG Mafia. It's a Bucharest Underground Mafia. That's their name. I'm a big fan of them. And when I was thinking, coming up with a new nickname, it just had a nice ring to it, Mob Man, you know? Yeah, yeah, I like it. Yeah. It's a trip, you know, to get here because for the last six years, I've known Mob Man to be a different guy.

9:14I'm aware. And now I feel like I've met a new Mob Man. So let's go back to the 90s. What was your early experience with just cybersecurity? It wasn't really a hacking thing. It was more of a programming thing. I taught myself to program when I was very little. I did a whole bunch of little games. This was back when I was still in Romania. So in 97, moved to Canada with the whole family. And then I found out about Delphi. I wanted to start learning in Delphi. So I just happened to pick a rat to work on. Basically, yeah. That was it. That's how everything started. And so, the story goes, Sub7 was born.

10:05Yeah. Well, it all stemmed from NetBus, right? It preceded Sub7. It was one of the original Trojans. It was called NetBus. So I played around with that a little bit, and that's kind of what inspired me to create something similar. What did NetBus do? It was the same thing, a remote-access Trojan. a rat. It had a little UI and a server you would send somebody and then connect to them. So that's kind of what I was trying to emulate when I started. And then after I got a couple of features going, I packaged it up and uploaded it to a hacking site. That started picking up steam. I had my contact details on there and people started sending me emails, contacting me.

10:57oh, can you add this? Can you add this? Can you add this? So that's kind of how it grew from there. I was like, hmm, I wonder if I can do this in Delphi. So I would look into it, do some research, see if I can find it out. And if it was possible, I would just do it. If you created this as like a coding challenge, did you ever feel bad when people used it for malicious purposes? It was all fun. At the beginning and for the first many versions, it was all just fun. Having fun with people, you know, playing tricks on them, pranks and things like that. That was the whole motivation behind it and everything else.

11:32But then started hearing all these stories about people using it for malicious purposes. Always in the back of my mind was sort of like, well, there's many of these tools available. They just happened to pick the one I made. They would have just picked a different one if it wasn't for Sub7. So, I mean, it's part of why I left, I guess, in the end. I wanted to get into something else, some sort of different. Throughout the whole thing, I was always tagged as a hacker. But I was just a programmer. I was trying to learn to program. The thing is, as this tool began getting popular, it started to be used more and more in criminal activity, using it to take over someone's computer.

12:17You can see exactly what they're doing on it. Or you could steal their files or session cookies or wipe their computer and delete everything. The problem is, creators of malware have sometimes been arrested just for creating it, not even doing anything bad with it. Because those creators were knowingly creating tools or weapons for criminals to do crimes with. Sub-7's official reason for existence was to prank people. It was for jokes and stuff. You know, some of the most popular features in it were the ones just for fun, like the Matrix one. You just turn your whole screen black and you type letters one by one.

12:52It was basically a chat, but you couldn't get out of it. You couldn't do anything. You would just chat back and forth with whoever was on the other end. But as it started being used for more malicious reasons, that's when Mob Man decided to leave the scene and basically not look back. He went on to programming and leaving the name Mob Man in the past too. The very first time I heard about somebody impersonating my name and taking credit for all this stuff was stemmed from your podcast. I had a local friend, Sebastian, we call him Septa, that is a big fan of your podcast and heard that you had an interview with Mob Man.

13:29And obviously he knew what that was, you know, and was looking forward to listening to it and listen to it. And he's like, what is this? Who is this guy? He sent me a message. He's like, yo, I listen to the podcast expecting you. And there's this other guy talking about some random stuff. I don't know what's going on. That's how I found out first. And then a couple of months later, Illwill contacted me. He's the one that started the whole process. He sent me a little zip file with a couple of details about me. He had a picture of my car. And he was like, the password for the zip file is your full name.

14:03So if it's really you, then you should be able to open it. He's like, I'm 99 % sure that it's you that I've traced you there. And I replied, I said, well, you're right. You can be 100 % sure now. And he was the one that kind of not convinced me because I was a little bit indifferent, right? Like, this was a long time ago. I don't know if I really want to get back into any of that. But he made a good point. Like, a lot of people have made their start with this, you know. And it's not right to have somebody else take the credit. Like, history should be set straight. So let's set the record straight.

14:39This is the real mom man, the actual creator of Sub-7. But even though this real mob man heard my interview with another mob man, he still didn't want to contact me to fix it. Because the whole thing was I didn't want to publicly say who I was. I didn't want to publicly admit all this stuff. Why was that? I don't know. I don't know. After a really, really long time, it didn't really make any sense to still stay hidden. Yeah, I mean, it makes sense. What you were saying a minute ago, which was like, I was young when I did that. I'm done with that. I don't want to be part of that. I don't want to revisit that.

15:16I can see there's a lot of reasons. What I was worried was like, oh, yeah, some people did some awful things with that. And the FBI is looking for me. I think people started getting in trouble for making tools like that at that point. Like you said, you know, like just for making them, not for actually using them. So that contributed to like, I need to get out of here. Yeah, and did you get any heat from law enforcement? No, no, I didn't. Because you had your email there, and I could see somebody being like, all right, we got to put an end to this guy. Yeah, no, no. I never got into any actual trouble or heard of anything.

15:57But I kept everything private, like everything. Nobody knew my name, even the people that were closest to me. Closest to me in the scene, like part of the crew and things like that. Nobody actually knew. They knew the city I was in. The very first version said the city I was in. It said from Windsor, Ontario. Okay, this makes sense. This is a tool that, while he has started a lot of cybersecurity careers, has also caused a lot of damage. And with people like Marcus Hutchins being arrested like three years after creating some malware, it makes sense for the real mob man to let someone else take credit since it'll allow him to stay hidden in real life.

16:33He has a bunch of family and stuff and just wants it all behind him. But after looking through Ill Will's research and speaking with this mob man for an hour, I'm convinced this is him. Wow. Six years after posting the episode, we finally discover the truth. And now we can lay it all to rest. But there's still something that's bugging me. Why would Greg pose as mob man all these years? We're going to take a quick break, but stay with us because when we come back, I'm calling Greg.

17:35great is that you don't need to spend hours pouring over every little detail. Shopify has thousands of templates and tools that help streamline website creation, making sure your site isn't just aesthetically pleasing, but functional at the same time. And you can draw customers in with the ease of convenience and checkout with ShopPay, Shopify's expedited checkout that saves customers information and reduces hassle. This Black Friday, join the thousands of new entrepreneurs hearing for the first time with Shopify. Sign up for your free trial today at shopify.com slash darknet. That's shopify.com slash darknet.

18:10Go to shopify.com slash darknet and make this Black Friday one to remember.

18:18Okay, time to call Greg, a.k.a. Mob Man. Hey, you there? Yeah, I'm here. Oh, hey, man. How have you been? Pretty good. Just busy working and sleeping and doing good stuff. The story of Sub7 has been researched more thoroughly since you have appeared on my podcast. And it just wasn't adding up for some people. And I was put in contact with the original author of Sub7.

18:55A Romanian fella named Mob Man.

19:02Okay. So, I mean, clearly, at this point, I'm believing that he's the one who created it, right? And so now I'm wondering, well, hold on. You're the one who said you created Sub-7. What's going on here? Right. So you introduced the helm through, I'm assuming, Will. Yep, Will Will.

19:30So they all like made a person. Did you check his ID or anything? But yeah, he seemed to be able to produce some evidence, right? So, I mean, I have a lot of that stuff too. He's just never asked. And I showed it to a couple other people that I know in my inner circles. So are we talking about the same sub-7 though? because this conflicting story is just not going to work for me. I've got to have a source of truth here. O.L.'s claims on his website we could go to. You put in Mob Man, it comes up in the Google searches. And there's all kinds of claims on that website. It's like it's reaching for straws every little thing.

20:12And then after 10 years, he finally gets enough straws to put together a whole fake persona or whatever he's doing for this other mob man person. My God, Greg is doubling down. He's saying he's the real mob man and this other guy is a made-up persona. All right. And then what about the Gmail account and the domain name? Okay, go ahead. Tell me. Well, does this other person have access to it? Or run it?

20:46To the Gmail account and domain name? Yeah. Yeah, that's hard-coded into the source code. And you're saying you do? I do. Okay. And then you can see the registration dates on them and stuff. Now it aligns all the times and they've never been kind of changed. Yeah. So maybe we get this other dude and me together. All right. I'll see if I can. You'd be wanting to talk with him. Will get Ill Will on the call too? I'd rather not talk with Ill Will. I mean, I think, you know, and quite honestly, you know, I try not to even talk about the subset or even anything that I've done in the past. But, you know, they got all these laws and computer laws and shit nowadays.

21:37It's like, you know, I don't want them to go retroactively and find some crap to get me even more in trouble. I'd like to meet the guy. Yeah. Whatever. And then we can see. We can get to the bottom of it. All right. All right. I'll see what I can do. Thanks for this call. I'll keep in touch. All right, bye. Bye.

22:03We got two mob band here now. This is crazy. I need some answers, though. I went back to the other mob band. I was like, hey, can we do a call with both of you? And he's like, yeah, let's do it. So we did the call. And I'll just play for you the conversation, mostly unedited. Hello. Hey, what's up? Hello. So I hit record already because this is such an epic call. I've never had two people of the same name on my podcast at the same time. There was nobody else named Jack? Honestly, as I was chatting with both of you, I was getting confused on who's who. When? Oh. Just because you're both named Marban.

22:42Oh. I know, it sucks. Because I'll be trying to play video games, and I'll sign up, and I'll put my name in there, and then I'll see it's taken. They'd be like, who the hell made that? Well, now you're done. Today you get to meet the person who made it. Yeah. Well, I don't know if he plays games. The one with the Romanian accent is the real one, just to set that up front. So do you play video games? Like Call of Duty or something? Who are you asking? I'm not here to socialize, dude. Okay, so yes Let's get into it What are we here for? We are here to discover It's not so much the name, right? People reuse names There's a lot of jacks in the world I'm not worried about my name being reused Or probably Mob Man has been reused before But the question at hand here is The creation of Sub7 is being claimed by both of you And the tricky part here is Neither of you really want to claim it because it's like, hey, man, that's kind of a sensitive subject.

23:47I don't really want to put my face in front of that thing because it has been used for purposes that maybe you don't want to claim or whatever. And so it is a tricky subject to try to navigate. But here's the situation where I'm trying to explain what this tool is, and I'm getting confused on who actually made it. Well, a few people made different versions of it. No, they did not. Only one person made all the versions. Oh, yeah? Go into every single version that was released into the credit screen, and under programmer, there's only one name ever. There's also multiple Romanian quotes from BUG Mafia.

24:34It's quite obvious that the author is fucking Romanian. Not some great guy from Florida, really. Why was there only one programmer of this app? Because it was just me doing everything. The whole source, I was in possession of it the whole time. Why is that? It was released a couple of months ago. Today you have GitHub, and it wasn't the same back in the 90s. But with GitHub, people can contribute and help out. You didn't want other people to help out. You didn't want to share the source code. Why was that? It's because it was a mess. I learned Delphi by working on Sub7. It was my very first project.