RAT Bought by 14,500 People Taken Down in International Operation

“A complex, challenging cyber investigation with international scope”

The UK’s National Crime Agency (NCA) says it has taken down a website which sold a hacking tool called IM RAT bought by cyber criminals in 124 countries, in a global operation led from Australia that resulted in 14 arrests and the seizure of more than 400 items.

Some 14,500 people across the world bought the Imminent Monitor Remote Access Trojan (IM RAT) from https://imminentmethods.net for as little as US$25, the NCA said today.

The RAT granted users full access to the infected device, enabling them to disable anti-virus software, steal data or passwords, record key strokes and watch victims via their webcams. The international operation was led by the Australian Federal Police (AFP), but appears to have led to a majority of arrests being in the UK (nine, out of the 14 globally).

Fourteen search warrants were executed across the UK, in Greater Manchester, Merseyside, Milton Keynes, Hull, London, Leeds, Walsall, Lancashire, Nottingham, Surrey, Essex and Somerset.

The warrants led to nine arrests and the recovery of 100 “exhibits.”

Australian police led a takedown of https://imminentmethods.net on the morning of Friday 29 November, the NCA said, dismantling the IM RAT toolkit in the process: the malware can no longer be used by its buyers.

Phil Larratt from the NCA’s National Cyber Crime Unit said: “Working with the NWROCU, AFP and a range of international and European partners we were able to support the takedown of a website that was distributing malware and facilitating hacking offences”

IM RAT “Used By Organised Crime Groups”

“The IM RAT was used by individuals and organised crime groups in the UK to commit a range of offences beyond just the Computer Misuse Act, including fraud, theft and voyeurism. Cyber criminals who bought this tool for as little as US$25 were able to commit serious criminality, remotely invading the privacy of unsuspecting victims and stealing sensitive data”.

Detective Inspector Andy Milligan from Australia’s NWROCU said: “This has been a complex, challenging cyber investigation with international scope. We have been supported throughout by the AFP, the NCA and our partners in Europol and Eurojust.  The UK’s Regional Organised Crime Unit (ROCU) network and Force Specialist Cyber Crime Units were pivotal during this phase of enforcement activity.

“The illicit use of IM RAT is akin to a cyber burglary, with criminals stealing data, including images and movies, secretly turning on web cams, monitoring key strokes and listening in to people’s conversations via computer microphones. Cyber Crime is not an anonymous victimless crime as some believe. There are real world consequences to people’s actions in cyber space and the international activity this week has shown how serious the UK treats this sort of criminality.”