(lava bubbling) - [Narrator] A bomb explodes in Rome. No one is injured. Brazil declares an end to the Zika virus as cases decrease. A band called Paramore releases
their fifth studio album. And in the farthest reaches of cyberspace, a small crypto worm is searching. It needs to escape this place. But it can't. Not until it finds an open port. Most of them are locked up securely. But one remains vulnerable. In the depths of the NSA, an exploit is discovered. Researchers find a vulnerability
in something called SMB, a communication protocol for shared access between files and devices. The worm is created and
kept as a secretive defense against future cyber attacks. Then one night it escapes. A link appears on social media. The link leads to an anonymous
content sharing platform. The platform leads to files, encrypted with a password. Three folders are inside. Among these is a familiar face. - [Robotic Voice] Eternal blue. - [Narrator] These are
called zero day RCEs. When executed, they'll
begin infecting computers with backdoor entrances, but they won't make
themselves visible right away. Instead they'll patiently
sit and quietly wait. The crypto worm begins work. Wannacry.exe releases a
password protected zip file onto the computer's main hard drive, inside this folder are
all the tools it needs for the job ahead. It downloads a Tor client
at the following URL, and extracts that to a
folder called task data. This client opens communication channels with five different servers. The worm ones to ensure it can write files on every hard drive, as fast as possible. To accomplish this, it opens
command prompt and runs. Now with full unprecedented access, it runs commands to terminate
every last connection to the outside world. (chaotic music) (goat bleating) Next, it scans all drives
for the following extensions. It locks them behind an
impenetrable wall of encryption. Then tags them with its mark. It then clears all recovery and backups and scans for any computers
connected to the same network. If found, it repeats the
process indefinitely. - Multiply. (indistinct) - [Narrator] After successfully
capturing its victim, it displays the simple message. (chaotic music) - Oh don't cry, are you? Aw. - [Robotic Voice] You
are watching Disrupt. - [Narrator] The head of
cyber defense operations at Microsoft releases a statement. For most, it's too late. Telefonica, a Spain based
telecommunications company halts their operations. FedEx apologizes to their customers. More than 15 national
health service facilities around England and all
of their patients halt. Around 300 people try
sending money to the address. A total of 51 Bitcoin is sent. Back then this was around. Today, it's around. Their files remained encrypted. (electronic music) A young cybersecurity specialist
is returning from lunch and he notices the massive spread. He throws aside a takeout
box and begins the defense. Marcus Hutchins, AKA MalwareTech starts uncovering bite
by bite, line by line, the foundations of wannacry. He runs a sample of the malware code inside a safeguarded analysis environment. And notices that the code
is trying and failing to connect to a domain. He checks if that domain is registered. The groundwork for something
called a sinkhole is linked. If successful, the server
will capture the traffic that the worm is sending, then stop it from traveling any further. Marcus registers the domain, runs the analysis environment, and crosses his fingers. (somber music) (plucky music) The smell of garbage
permeates the street corner, but Jeremy Jemena is used to it. He's worked this route for years. On a street called Passion Monte in a town called Taytay in
the country of the Philippines on planet earth. The collector gets off and begins loading the bags into the back. Old grain, pizza boxes, toilet paper. Lastly, Jemena picks up at bedspread. (mysterious plucky music) The local police tape off the area and begin their investigation. Autopsies revealed the
victim as a Catherine Lee. Instantaneous death. Days later, her husband requests that the case be elevated
from the local police to the national bureau of investigations. Agent Rizaldy Rivera is on the job. He discovers that Catherine
Lee was a real estate agent. (chill music) Bill Maxwell states that
he and his colleague, Tony are looking for real estate on the island. The only stipulation that
it be a good investment. Bill and Tony introduced
themselves as Canadians. Catherine Lee introduces them to her two other real estate brokers that would be joining the tours. Somewhere along the route, the two brokers split up. And Catherine Lee is murdered. Agent Rivera tries tracing the plates of the silver Toyota only to find it hadn't checked
with the security guard at one of the properties
the convoy viewed, the guard procures a registration number from the vehicle's temporary tag, crosschecks this with the
local Toyota dealership. He traces the bullets
to a 22 caliber handgun. He tries running the
names of the two Canadians in the Bureau's immigration database. Bill Maxwell, Tony, no last name. For the next three years, the case goes cold. (phone ringing) - [Robotic Female Voice] Call from: US Drug Enforcement Agency. press one to- (button tone dials) Across cyberspace two Canadians
were emailing back and forth with someone in the United States. This was by a screen name Rambo who subsequently forwards the information to another individual, screen named Benny. Benny wires more money to Rambo who uses it to buy a 22 caliber handgun, and sends it to the Canadians. A few days later, Rambo
receives another message. Investigators decode
that the two Canadians aren't Canadian at all, they reside in North Carolina, identified now as Adam Semia and Carl Stillwell. Pictures of the bike, which he named. The two are arrested,
given life sentences. But to agent Rivera,
something doesn't add up. (cyber music) What the agents from
the US embassy told him would be the start of
uncovering the largest cyber criminal enterprise in history, a dark empire in the
shadows for nearly a decade. (somber music) Around the world every infected machine connects to the sinkhole. Defenses are reinforced and
over the next three days, the team play a metabolic
game of tug of war between offense and defense. A security researcher in
France finds an antidote. When a regular system generates
an RSA encryption key, it must choose between
two primary numbers. Once the key is registered, those primary numbers are
typically stored for safekeeping, as they can be used to regenerate the original encryption key. Whatever created the virus didn't wipe those prime
numbers from the system. They remain in the cache. Adrien Guinet releases
the WannaWiki encrypter which recovers those prime
numbers from the PC memory, then attempts its final revival. Clues surface about the
birth place of origin. The first clue, the ransom notes appear to be machine translated from English. Next, the inner files contained fonts in the Hango language. Lastly, the metadata points to a computer that was used to write the viruses being set to the UTC time zone. However, this is as far as they get. Over the following years, variants spawn in the wild. Over 12,000 different worms begin wreaking small-scale
havoc on their prey. But none of them have
as large of a footprint as the original, the same protocol is prevalent, crawling into the open network port, seizing control, demanding payment. - [Narrator 2] So here is
the actual WannaDecrypt that pops up. We can see our files
just disappeared here. They have all been encrypted
and now no longer function. (hiphop music) (dog barks)
(busy music) - [Narrator] Small town, middle America A box arrives from FedEx. Inside our Soma pills, a muscle relaxer. Obtained through a network laid in place thousands of miles away. First, the customer receives an email from a generic prescription drug website. The customer selects what she wants, fills out her symptoms,
pays by credit card. The order is collected by a
company called RX Limited, and relayed to one of
the mini American doctors who they've partnered with. The doctor reads the symptoms, then fills out a prescription form. The form is then sent to an independent pharmaceutical retailer who reads the prescription, fills the order and sends it
right back to the customer. - [Female Narrator] Sadness,
loss of interest, anxiety. - [Narrator] The pipeline is
for the most part, automated, with customer service being handled at call centers in Israel. One of these call centers is
interviewing a new employee, Morin Oz. He heard about the job from
a friend's brother-in-law. The boss is named Boaz Taggart. Boaz says he started the
company with his brother Tomar and a silent partner. The company services a
larger network of websites, including RX Limited and
another one called Alphanet. Morin Oz takes the managerial job. He's told to adopt an
American sounding name. Told to say they're from Utah, not Israel. Their biggest sellers are
Soma, Fioricet and Ultram. Occasionally one of their
prescription funnels goes offline. Regulatory issues. Then, it returns. Over the subsequent months, the company grows rapidly, steady upward growth. Oz is making good money,
decides to take a vacation. Upon returning, he finds that
Boaz has left the business. His brother Tomar is now in charge. Over the next year,
things continue normally, steady upward growth. Then, Tomar is out. Signed. Oz inquires with his coworkers. It's the silent partner. The new boss doesn't
show up to the office. Only takes some calls or
communicates via email. Says he's too busy to travel. He insists Oz encrypts his
hard drive with a program called E4M. Over the subsequent months,
things continue as normal. Steady, upward growth. Then he informs Oz he wants to meet. Oz and his coworker Bergman
finally meet their boss. He informs them he's opening
a new call center in Tel Aviv. He wants them to staff and oversee it. The endeavor would be called CSWW. The business opens. Each month, they receive a
wire transfer from Hong Kong to cover operation costs. Steady, upward. A new hire Levi Kugel, an
American joins the operation. RX Limited is growing so quickly that it's finding difficulty
finding enough pharmacies to fill orders. Oz and Levi begin
discussing the possibility of starting their own
wholesale pharmacy in the US to help fill in those
orders at a lower cost to save their boss money. He's picked up at his hotel
by an American named Dave. They ride to one Paul's yachts. The plan is to travel for
the day to a small island that house the center, do the inspection, spend
the night, then head back. As the shore shrinks on the horizon, Oz takes a drink from a
champagne glass one moment, then finds himself hurling towards the ocean surface the next. He's greeted with the
barrel of a nine millimeter. He hears Dave yelling at him. He tries to plead with a man. Wondering why. David says something into a
satellite phone he's holding. He's pulled back on board, driven back to the hotel and dropped off. Paul denies any knowledge of the event. Christmas Eve. A baby boy is born. First name. He's adopted by a loving family. His family moves to South Africa where his father starts a company. He does well in primary school. Good grades, friendly
demeanor, clean as a whistle. He's not a huge fan of sports. Instead he takes to wing commander. One day, his father proposes a deal, clean the car, get a computer. Deal accepted. Atari SD. From here, the boy dives deep into code, creating worlds. At 15 police storm the family home. Paul was arrested for selling porn. At 16, he drops out of high school. At 17, he moves out. By the late 90s he's married
and residing in Australia, and he's just released
an encryption program. The manifesto posted on the website reads. It's a solid piece of
software and it grows popular, but he releases it for free
and he's struggling for cash. His marriage falls apart
and he moves to Hong Kong, then Rotterdam and the Netherlands, marries again, has a kid, launches a software development company. One of his clients is Wilfred Hafner, an Italian engineer. Wilfred hires Paul and to build
a package piece of software similar to his early
E4M encryption program. They call it Drive Crypt. Hafner discovers that
Paul has been funneling some of the work he's been
creating for Drive Crypt into an unnamed personal project. He's fired. Paul goes underground. Another company is registered. IBS Systems, which would later become
a division of Rx Limited. Rx Limited now has tens of
thousands of various domains fronted as separate
pharmaceutical companies. Paul creates his own domain register. When one gets squashed, another appears. Capitalizing on the
opioid crisis of America. It's estimated the company is pulling in 400 million per year. He operates his empire
over the vast reaches of inverted cyberspace. And by 2010, he's ventured from pharmaceutical
drugs to weapon shipments. Pushes buttons in the virtual worlds, and his minions in the
physical world execute. Bruce Jones is a captain, he's approached by a fellow Englishman about a job sailing a shipment
from Turkey to Indonesia, to the Philippines. The job would be paid for
by a La Plata Trading. Shipping guns, all above table. He's told. Him and his new Georgian crew
sail from Turkey to Ghana to the Congo, then to Indonesia. Jones receives a call informing him to go to Subic bay and wait. Days pass. More days. With the unplanned delay, Jones has to return home. His wife is expecting
their child any day now. Jones jumps in a buoy and is replaced by a different pilot
who continues the job. Eventually the ship is
called out of the delay. As they're pulling out, local fishermen call the police. The boat is surrounded. They demand the cargo manifest. The new captain doesn't have it. (heavy bass music) (gun firing) Joseph Hunter is the strong arm of Paul's empire. He enlisted in the army in 1983, joined the Rangers in 1985. And after the death of
a friend in his unit, he was discharged from the Rangers due to psychological trauma. He then continues his service in the army as a sniper instructor, stationed in Puerto Rico. Over the next two decades, he achieves Sergeant first class. Hunter returns to his hometown
of Owensboro, Kentucky with his wife, boys, and dogs. He becomes an inmate counselor. Hunter quits the correctional
facility and joins DynCorp. Job description, security at
the US embassy in Baghdad. A former soldier
introduces the military man to the businessman. Within months, Hunter is hired by Paul under fake pseudo names. Among the jobs Paul hires hunter to do, one is to organize a hit on the captain of the seized shipments. Over the years, the many tentacles
spanning drug businesses, weapons shipments, golden
diamond smuggling are secured or hunted by Rambo. Paul needs a way to secure his loop. He converts easily traceable
cash with the cold hard assets. The more he attains, the
more paranoid he becomes. (woman speaking indistinctly) Paul closes his operation
in the Philippines, moves to Rio de Janeiro, and sits on his pile with
a new wife and child. But it's not enough. He receives a message
from a former employee. Paul books a flight to
the capital of Liberia to meet with the newly connected contact. Then Paul goes quiet. Hunter goes back to work. He needs to assemble three guys for a quote unquote special job. He spends the next few months sifting through resumes from mercenaries. A few standout. Suborski, an ex Polish police who said he provided protection for president Bush and Pope
John II while in Poland. The second is Gogal. He served in the German army, then moved into private security, specializing in tracking
down Somali pirates. Gogal connects hunter
with the last one, Filter. A family man, with two young daughters. Hunter arrives in Thailand, The first time they've all met in person. The Colombians have a
series of small time jobs for the crew, mainly countersurveillance. They're stationed in various
positions at pickup spots, tasked with ensuring police
aren't monitoring things. Then Paul, under the name John sends an email to Hunter
under the name of Jim about a snitch inside their operation. They would intercept a
meth shipment Liberia in which the DEA agent or
snitch was supposedly involved. The team stands by, waiting for the last
coordinates from Hunter. Unarmed and off guard, Joseph Hunter is detained. Followed by Suborski, Filter and Gogal. A pharmacy on the south
side of Chicago is raided. In the back, they find boxes upon boxes of FedEx shipments full of medications. Kim Brill, a DEA investigator at Minneapolis St. Paul begins digging. She gets a warrant and
searches within FedEx's records leading her to a company
called RX Limited. Alongside she finds that
hundreds of pharmacies sprinkled throughout the US are shipping under the same FedEx account. First, the shipments, then the pharmacies, then the websites that those pharmacies
receive their orders from, then the servers behind those websites, and finally, the company
behind the registered domains. The paper trail leads them to Hong Kong, in which they discover
millions of dollars flowing in and out of various shell companies. Vishnu, East Asia Escrow,
Ajax Technologies, all connected to central
accounts held by one. Robert McGowan is a
former employee of Paul. He was tasked with a secretive project in the democratic Republic of Congo. Eventually, he stomped the job. Paul subsequently used Robert's legal name to register various company documents. One of these is called Southern Ace. Southern Ace is then used to funnel money into one of Paul's Somalian Militias. After a while, Paul abandons the project, stops the money transfers. Local authorities uncover more information about the militia, then
relay it to the FBI who are led to Robert McGowan. Robert receives a call
from the DEA with an offer. Paul takes the bait. He boards the plane to meet up with his Colombian associates. Steps onto the runway and is
seized upon by the agents. The DEA doesn't want to publicly announce their king pen has been captured. They still have a use for him. Using Paul's formerly encrypted email, agents act on his behalf, pushing buttons within
his corrupt network. Over the next year, the DEA begins slowly
dismantling the empire, setting up stings. Among those is Rambo. Joseph Hunter admits to
the organized killing of the real estate agent from the Manila. Months before her death, Paul gave her nearly 3 million to purchase property in the country. She then hired someone to
do diligence on the deal. The report says the individual she hired ran off with the money. Upon receiving the news, Paul hired Hunter to
eliminate both of them, who subsequently hired the two
gunman to complete the job. Hunter's three other gunman plead guilty to conspiracy to murder the DEA agent. (somber music) - [Woman] There are a thousand different possibilities for anything, like a stuffed animal
you have on your bed. It looks like how it looks, but it could be at a
slightly different angle. It could have different threading. It could be infinitely different, and we don't know how it would
look if it was different, because all we know is this. There is no certainty that
you will live until tomorrow. There is no certainty that
the universe will last as long as we think it will last. And that's amazing. (mysterious music) (men speaking indistinctly)
