By Staff Writer.
A misspent youth has come back to haunt a Melbourne man after Australian Federal Police charged him for creating and selling spyware online from his bedroom when he was a teenager. The charges stem from a 2017 FBI tipoff that sparked a multi-jurisdictional global investigation.
The man, now 24, appeared before the Brisbane Magistrates Court on Friday, July 29, after the AFP laid six charges carrying up to 20 years prison time.
The AFP alleges the man created a Remote Access Trojan (RAT) he called Imminent Monitor (IM) and then sold it online to over 14,500 people in 128 countries for AU$35. For his troubles, the then teen earned over half a million dollars.
Once the spyware was installed, IM could control a victim’s computer, log keystrokes, steal personal information or spy on users by turning on webcams and microphones.
“These types of malware are so nefarious because it can provide an offender virtual access to a victim’s bedroom or home without their knowledge,” said AFP Commander of Cybercrime Operations Chris Goldsmid.
Between 2013 and 2019, the AFP allege the then teenager created and marketed IM on the dark web while living in Brisbane with his mother. His online activities sparked an alert at cybersecurity business Palo Alto Networks, which informed the FBI, who informed the AFP.
The teenager’s activities sparked a global investigation involving over a dozen international law enforcement agencies. By 2019, the AFP had enough information to identify the RAT’s creator.
The AFP obtained search warrants on a Brisbane home that resulted in the AFP seizing a custom-built computer “containing code consistent with the development and use of the RAT.” Simultaneously, the AFP shut down operation of the RAT across the globe.
What caused the AFP the most concern during the investigation was learning an abnormally high proportion of the teen’s 201 Australian customers were listed on domestic violence orders, and one was on the child sex offenders register.
“Unfortunately, there are criminals who not only use these tools to steal personal information for financial gain but also for very intrusive and despicable crimes,” said Commander Goldsmid.
Despite putting the teen out of business in 2019, it wasn’t until early July 2022 that the AFP had completed their investigation and proceeded to lay charges.
The now adult male faces one count of producing data with intent to commit a computer offence; two counts of supplying data with intent to commit a computer offence; one count of aiding, abetting, counselling or procuring the commission of an offence; and two counts of dealing in the proceeds of crime to the value of $100,000 or more.
The AFP isn’t exactly sure how many people have the spyware installed on their devices, but they estimate it could be in the tens of thousands worldwide. They note while it isn’t unlawful to buy a RAT, it is illegal to install one secretly. In addition to the RAT’s creator, the global investigation saw 85 search warrants executed, 434 devices seized, and 13 other people arrested.
One of those people receiving an unwanted knock on the front door was the man’s mother, now aged 42. She faces one count of dealing with the proceeds of crime and appeared before the court on the same day as her son last week. The Magistrate adjourned the matters until mid-August.
