A man has been charged by federal police for allegedly creating and selling spyware that allowed criminals, including domestic violence perpetrators, to remotely take control of people’s computers – all while he was only a teenager.
The man will front in Brisbane Magistrates Court on August 19 following a brief appearance on Friday.
Police allege he was just 15 years old when he created the Remote Access Trojan (RAT), before selling it to thousands of people across the globe between 2013 and 2019.
The spyware, named Imminent Monitor, was allegedly sold to 14,500 customers across 128 countries. Federal police also identified 201 Australians who bought the RAT.
14.2 per cent of these people are named as respondents on domestic violence orders while one is a registered Child Sex Offender, an AFP spokesperson said.
Of the 14 individuals, 11 bought the RAT during the active period of their domestic violence order (DVO) or within two years a DVO was issued.
Once the spyware was installed on a victim’s computer, users could control it, steal their personal information or spy on them by turning on the device’s webcams or microphones, all without their knowledge.
The AFP said the spyware could also log keystrokes, allowing users to see what was being written in emails or documents, like home addresses.
“The spyware could be installed a number of ways, including phishing (duping a victim into opening an email or text message),” the AFP spokesperson said.
The AFP believes there were tens of thousands of victims globally, 44 of which were identified in Australia.
Police allege the RAT cost about $35AUD and was advertised on a hacking forum.
It is alleged the man made between $300,000-400,000 from selling the malware.
The man was issued with a summons earlier this month at his Melbourne home and has been charged with six offences, including producing data with intent to commit a computer offence, aiding, abetting, counselling or procuring the commission of an offence namely the unauthorised modification of data to cause impairment, and dealing with the proceeds of crime to the value of $100,000 or more.
A woman, 42, who lives at the same address as the man, was also served a summons to face one count of dealing with the proceeds of crime to the value of $100,000 or more.
She also faced Brisbane Magistrates Court on Friday.
The AFP’s investigation, dubbed Operation Cepheus, began after a tip-off from cyber security firm Palo Alto Networks and the FBI in 2017.
It sparked a global investigation where 85 search warrants were executed all over the world.
AFP Commander Cybercrime Operations Chris Goldsmid said cyber jobs could often be abstract for many in the community but this operation provided clear and real examples of how dangerous tech-enabled crime could be.
“These types of malware are so nefarious because it can provide an offender virtual access to a victim’s bedroom or home without their knowledge,’’ Commander Goldsmid said.
“Unfortunately there are criminals who not only use these tools to steal personal information for financial gain but also for very intrusive and despicable crimes.”