Police allege that a teenager living in the suburbs of Brisbane created and sold a sophisticated hacking tool used by domestic violence perpetrators and child sex offenders to spy on tens of thousands of people across the globe – and then used the proceeds to buy takeaway food.
Jacob Wayne John Keen, now 24, was 15 years old and living in his mother’s rental when he allegedly created a sophisticated spyware tool known as a remote access trojan (RAT) that allowed users to remotely take control of their victims’ computers.
Called Imminent Monitor, once installed it could be used to steal victims’ personal information, spy on them via webcams and microphones and track what they typed into emails or documents.
Keen allegedly sold the tool for $35 on a hacking forum, making between $300,000 and $400,000 by selling it to more than 14,500 people in 128 countries.
Among them were domestic violence perpetrators and other criminals, according to a statement issued by the Australian federal police. The AFP said on Saturday it had confirmed 201 Australians had bought the spyware.
Of those, the agency said, a “statistically high” proportion were named as respondents on domestic violence orders. The agency asserts that one buyer was on the child sex offenders register.
The AFP said it believed there were tens of thousands of victims globally, including 44 in Australia. It said investigations into potential suspects who may have used the device were ongoing.
According to the agency, a financial analysis had discovered that most of the money raised from allegedly selling the spyware was used to pay for food delivery services “and other consumable and disposable items”.
Keen was slapped with six charges earlier in July, and is due to appear at Brisbane’s magistrates court next month. His mother, 42, has also been charged with allegedly dealing in the proceeds of crime.
The pair had been due to appear in Brisbane’s magistrates court on Friday, but the case was laid over until next month.
The arrest was announced on Saturday following a coordinated global policing sting dating back to 2017.
Dubbed Operation Cepheus, it began when the AFP received information from cybersecurity firm Palo Alto Networks and the FBI about a suspicious malware.
A global investigation involving more than a dozen law enforcement agencies across Europe led to 85 search warrants being executed around the world, with 434 devices seized and 13 people arrested for using the malware for “alleged criminality”.
By 2019 the tool had been shut down, but after receiving evidence from overseas law enforcement, the AFP arrested Keen.
“The AFP-led investigation executed two search warrants in 2019 at the man’s then home in Brisbane,” the agency said in a statement. “Investigators seized a number of devices, including a custom-built computer containing code consistent with the development and use of the RAT.”
The AFP commander of cybercrime operations, Chris Goldsmid, said the operation provided a real example of how dangerous tech-enabled crime could be.
“These types of malware are so nefarious because it can provide an offender virtual access to a victim’s bedroom or home without their knowledge,” he said.
