Download original attachment
(PDF file)

This is an HTML version of an attachment to the Freedom of Information request 'Internal documentation pertaining to "Operation Shrouded Horizon" or the takedown of dark0de'.



s 22(1)(a)(ii)
From:
s 22(1)(a)(ii)
Sent:
Thursday, 19 February 2015 7:04 PM
To:
s 22(1)(a)(ii)
s 47E(d)
Cc:
s 22(1)(a)(ii)
Subject:
RE: Darkode meeting 19 February [SEC=PROTECTED]
PROTECTED, Sensitive 
Thanks
s 22(1)(a)(ii)
I will attend the meeting & advise the outcomes.
has
s 22(1)(a)(ii)  given me the information  
Sorry, I don’t have any further details either. 
s 22(1)(a)(ii)
s 22(1)(a)(ii)
LIAISON OFFICER - EUROPOL 
SERIOUS & ORGANISED CRIME 
Tel 
s 22(1)(a)(ii)
www.afp.gov.au 
PROTECTED, Sensitive 
From:
s 22(1)(a)(ii)
Sent: Thursday, 19 February 2015 3:25 PM 
To:
s 22(1)(a)(ii)
s 47E(d)
Cc:  s 22(1)(a)(ii)
Subject: RE: Darkode meeting 19 February [SEC=PROTECTED, DLM=Sensitive] 
PROTECTED, Sensitive 
Hi
s 22(1)(a)(ii)
I spoke to
an
s 22(1)(a)(ii)d
abou
s 22(1)(a)(ii)
t this and they were more interested to find out what the meeting was 
about. We don’t really have anything to discuss (or contribute at this stage) and I think
ha
s 22(1)(a)(ii) s briefed 
you on some of the people we have an interest in on this forum. 
Some more information about this operation might put us in a better position to contribute something. 
Cheers 
s 22(1)(a)(ii)
s 22(1)(a)(ii)
CYBERCRIME OPERATIONS 
HIGH TECH CRIME OPERATIONS 
Tel 
s 22(1)(a)(ii)
Exts 22(1)(a)(ii)
www.afp.gov.au 
1
LEX 3253
Folio 1

PROTECTED, Sensitive 
From:
s 22(1)(a)(ii)
Sent: Thursday, 19 February 2015 12:32 AM 
To:
s 47E(d)
Cc:
s 22(1)(a)(ii)
Subject: Darkode meeting 19 February [SEC=PROTECTED, DLM=Sensitive] 
Importance: High 
PROTECTED, Sensitive 
Morning 
I have received a meeting request in relation to the Darkode investigation. 
s 47E(d)
Thanks 
s 22(1)(a)(ii)
s 22(1)(a)(ii)
LIAISON OFFICER - EUROPOL 
SERIOUS & ORGANISED CRIME 
Tel 
s 22(1)(a)(ii)
www.afp.gov.au 
PROTECTED, Sensitive 
2
LEX 3253
Folio 2


From:
s 22(1)(a)(ii)
To:
s 47E(d)
Cc:
s 22(1)(a)(ii)
Subject:
Darkode Reporting [SEC=UNCLASSIFIED]
Date:
Thursday, 16 July 2015 6:26:00 AM
Attachments:
image001.gif
UNCLASSIFIED
International cybercrime marketplace taken down
http://www.post-gazette.com/business/tech-news/2015/07/15/International-
cybercrime-ring-bust-to-be-announced/stories/201507150167
Related: Indictment of Mafi
http://www.post-gazette.com/attachment/2015/07/15/Indictment-of-Johan-Anders-
Gudmunds.pdf
Malware And Hacking Forum Darkode Is Shut Down; Dozens Arrested
http://www.npr.org/sections/thetwo-way/2015/07/15/423196810/malware-and-
hacking-forum-darkode-is-shut-down-dozens-arrested
Darkode Shutdown: Former FireEye Intern Accused Of Creating $65,000
Android Malware
http://www.forbes.com/sites/thomasbrewster/2015/07/15/fireeye-intern-dendroid-
charges/
FEDERAL AGENT
s 22(1)(a)(ii)
CYBERCRIME OPERATIONS
ORGANISED CRIME & CYBER
Tel 
s 22(1)(a)(ii)
www.afp.gov.au
UNCLASSIFIED
LEX 3253
Folio 4


s 22(1)(a)(ii)
From:
s 22(1)(a)(ii)
Sent:
Wednesday, 15 July 2015 3:05 PM
To:
s 22(1)(a)(ii)
s 47E(d)
Subject:
RE: darkode banner up [SEC=UNCLASSIFIED]
UNCLASSIFIED 
Good‐o 
s 22(1)(a)(ii)
TEAM LEADER CYBERCRIME OPERATIONS 
ORGANISED CRIME & CYBER 
Tel 
s 22(1)(a)(ii)
Ext
Mob
s 22(1)(a)(ii)
s 22(1)(a)(ii)
www.afp.gov.au 
UNCLASSIFIED 
From: s 22(1)(a)(ii)
Sent: Wednesday, 15 July 2015 3:03 PM 
To:
s 47E(d)
Subject: darkode banner up [SEC=UNCLASSIFIED] 
UNCLASSIFIED 
s 22(1)(a)(ii)
SENIOR TECHNICAL ANALYST 
ORGANISED CRIME & CYBER 
Tel 
s 22(1)(a)(ii)
Mob
s 22(1)(a)(ii)
www.afp.gov.au 
UNCLASSIFIED 
1
LEX 3253
Folio 5
s 22(1)(a)(ii)
From:
s 22(1)(a)(ii)
Sent:
Thursday, 16 July 2015 7:49 AM
To:
s 47E(d)
Subject:
Higher Res darkode takedown banner
Attachments:
951.jpg
In case anyone wants one 
1
LEX 3253
Folio 6

From:
s 22(1)(a)(ii)
To:
s 47E(d)
Subject:
darkode banner up [SEC=UNCLASSIFIED]
Date:
Wednesday, 15 July 2015 3:02:57 PM
Attachments:
CJ6mzNEWcAAK0P6.jpg
image001.gif
UNCLASSIFIED
s 22(1)(a)(ii)
SENIOR TECHNICAL ANALYST
ORGANISED CRIME & CYBER
Tel
s 22(1)(a)(ii)
Mob 
s 22(1)(a)(ii)
www.afp.gov.au
UNCLASSIFIED
LEX 3253
Folio 7










Page 18 redacted for the following reason:
- - - - - - - - - - - - - - - - - - - - -
s 33(a)(iii), s 47E(d), s 22(1)(a)(ii), s 47F(1)


Printed By: s 22(1)(a)(ii)
Date/Time Printed: 09 Jan 2025 at 10:41:02 
Australian Federal Police - Production 
Page:2 of 3 
Case Note: (151364291) 1/4/2015 FW: 
s 47E(d)
s 47E(d)
Thanks!
s 47F(1)
s 47F(1)
Research Analyst | Ext. s 47F(1)
_________________________________________________________________________
CONFIDENTIALITY NOTICE 
This e-mail message and any attachments are only for the use of the intended recipient and may contain information that is privileged, 
confidential or exempt from disclosure under applicable law. If you are not the intended recipient, any disclosure, distribution or other use of 
this e-mail message or attachments is strictly prohibited. If you have received this e-mail message in error, please delete and notify the 
sender at (412) 802-8000 immediately. Thank you.
The information contained in this report is not to be disseminated to a third party or to be used in such a way as to prejudice an ongoing investigation by the AFP. Should 
any information provided in this report fall within the ambit of a freedom of information request, a subpoena, summons to produce or similar process, the AFP should be 
consulted before releasing information.
LEX 3253
Folio 20

Printed By: s 22(1)(a)(ii)
Date/Time Printed: 09 Jan 2025 at 10:41:02 
Australian Federal Police - Production 
Page:3 of 3 
Case Note: (151364291) 1/4/2015 FW:
s 47E(d)
Involvements:
Case ID
Log #
Title
Created By
Date Created
5767947 
129 
INTN-NCFTA-PITTSBURGH-STRATEGIC 2015  
s 22(1)(a)(ii)
03 Apr 2015 01:59
Attachments:
ID
Object Type
Title
Created By
Date Created
8432745 
AFFIDAVIT/INFORMATION 
1/4/2015
s 47E(d)
s 22(1)(a)(ii)
03 Apr 2015 01:59
The information contained in this report is not to be disseminated to a third party or to be used in such a way as to prejudice an ongoing investigation by the AFP. Should 
any information provided in this report fall within the ambit of a freedom of information request, a subpoena, summons to produce or similar process, the AFP should be 
consulted before releasing information.
LEX 3253
Folio 21






Pages 28 through 29 redacted for the following reasons:
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
s 33(a)(iii), s 33(b), s 47E(d), s 47F(1)
s 33(a)(iii), s 33(b), s 47F(1), s 22(1)(a)(ii), s 47E(d)

From:
s 22(1)(a)(ii)
To:
s 22(1)(a)(ii)
Subject:
s 33(a)(iii)
[DLM=For-Official-Use-Only]
Date:
Friday, 4 September 2015 5:08:00 AM
Attachments:
image001.gif
For-Official-Use-Only
Hi s 22(1)(a)(ii)
s 33(a)(iii), s 33(b)
Thanks for your help,
 
s 22(1)(a)(ii)
FEDERAL AGENT
s 22(1)(a)(ii)
NATIONAL CYBER-FORENSICS & TRAINING ALLIANCE, PITTSBURGH
INTERNATIONAL OPERATIONS
Tel 
s 22(1)(a)(ii)
ext  
Mob 
s 22(1)(a)(ii)
s 22(1)(a)(ii)
www.afp.gov.au
 
For-Official-Use-Only
LEX 3253
Folio 30


For‐Official‐Use‐Only 
 
Hey 
s 22(1)(a)(ii)
Can you have a quick look at this as a mansig and let me know if you have any suggestions.  
 
Thanks for your help, 
 
s 22(1)(a)(ii)
Background 
Commencing in 2012 a multilateral investigation led by the FBI has been underway relating to the activities 
of persons utilising the "Darkode" online criminal forum. Darkode is an English speaking forum where 
members meet to discuss, share and trade malware and communicate in general about compromising 
computer systems and trading stolen data. 
s 33(a)(iii)
s 33(a)(iii)
s 47E(d)
s 33(a)(iii)
Issues/Event 
s 33(a)(iii), s 33(b), s 47F(1)
Intended action/outcome 
s 33(a)(iii)
Media 
3
LEX 3253
Folio 33


His 22(1)(a)(ii)
Thanks for your help with the matter.
s 47E(d)
s 47E(d)
Thanks again, 
 
s 22(1)(a)(ii)
FEDERAL AGENT
s 22(1)(a)(ii)
NATIONAL CYBER-FORENSICS & TRAINING ALLIANCE, PITTSBURGH
INTERNATIONAL OPERATIONS 
Tel 
s 22(1)(a)(ii)
ext
Mob 
s 22(1)(a)(ii)
s 22(1)(a)(ii)
www.afp.gov.au 
 
For‐Official‐Use‐Only 
 
s 33(a)(iii), s 33(b), s 47F(1), s 22(1)(a)(ii)
Pages 36 through 38 redacted for the following reasons:
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
s 33(a)(iii), s 47E(d), s 47F(1)
s 33(a)(iii), s 47E(d), s 47F(1), s 22(1)(a)(ii)
s 33(a)(iii), s 47E(d), s 47F, s 22(1)(a)(ii)
********************************************************************** 
WARNING 
 
This email message and any attached files may contain information 
that is confidential and subject of legal privilege intended only for 
use by the individual or entity to whom they are addressed. If you 
are not the intended recipient or the person responsible for 
delivering the message to the intended recipient be advised that you 
have received this message in error and that any use, copying, 
circulation, forwarding, printing or publication of this message or 
attached files is strictly forbidden, as is the disclosure of the 
information contained therein. If you have received this message in 
error, please notify the sender immediately and delete it from your 
inbox. 
 
AFP Web site: http://www.afp.gov.au 
********************************************************************** 
 
 
9
LEX 3253
Folio 39
Pages 40 through 43 redacted for the following reasons:
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
s 33(a)(iii)
s 33(a)(iii), s 22(1)(a)(ii), s 47F(1), s 47E(d)
s 33(a)(iii), s 33(b), s 22(1)(a)(ii)
s 33(a)(iii), s 33(b), s 47F(1), s 22(1)(a)(ii)

s 33(a)(iii), s 33(b)
Kind regards, 
s 22(1)(a)(ii)
BACKGROUND INFORMATION:  
s 33(a)(iii), s 33(b), s 47F(1)
Recommendation:  
s 33(a)(iii), s 33(b)
 
 
2
LEX 3253
Folio 45


s 22(1)(a)(ii)
From:
s 22(1)(a)(ii)
Sent:
Wednesday, 29 July 2015 2:48 PM
To:
s 22(1)(a)(ii)
Subject:
RE: Weekly Report Reminder [SEC=PROTECTED]
PROTECTED 
 
 
His 22(1)(a)(ii)
Weekly report attached.  
 
Thanks,  
 
s 22(1)(a)(ii)
s 33(a)(iii)
FEDERAL AGENT
s 22(1)(a)(ii)
NATIONAL CYBER-FORENSICS & TRAINING ALLIANCE, PITTSBURGH
INTERNATIONAL OPERATIONS 
Tel 
s 22(1)(a)(ii)
ext
Mob 
s 22(1)(a)(ii)
s 22(1)(a)(ii)
www.afp.gov.au 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
1
LEX 3253
Folio 47

 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
PROTECTED 
 
From:
s 22(1)(a)(ii)
Sent: Thursday, 29 January 2015 10:08 AM 
To:  s 22(1)(a)(ii)
Subject: Weekly Report Reminder [SEC=UNCLASSIFIED] 
 
UNCLASSIFIED 
 
Morning
do yo
s 22(1)(a)(ii)
u have any input for next week’s Weekly Report? 
 
Cheers 
s 22(1)(a)(ii)
s 22(1)(a)(ii)
PROJECT OFFICER / INVESTIGATIVE ASSISTANT - WASHINGTON POST 
SERIOUS & ORGANISED CRIME 
Tel 
s 22(1)(a)(ii)
Mob 
s 22(1)(a)(ii)
www.afp.gov.au 
 
UNCLASSIFIED 
 
2
LEX 3253
Folio 48



LEX 3253
Folio 49

LEX 3253
Folio 50
Pages 51 through 55 redacted for the following reasons:
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
s 47E(d)
s 47E(d), s 47F(1)