Europol Shuts Down ‘Imminent Monitor’ RAT Operations With 13 Arrests

The operation targeted both buyers and sellers of the
IM-RAT (Imminent Monitor Remote Access Trojan), which was
sold to more than 14,500 buyers and used against tens of thousands
of victims across 124 countries.

The infrastructure and front-end sale website of the Imminent
Monitor have also been seized as part of this operation, making the
Trojan unusable for those who already bought it, as well as
unavailable for the new users.

Promoted as a legitimate remote administration framework, the
hacking tool was widely used to unauthorisedly access targeted
users’ computers and steal their login credentials for online
banking and other financial accounts.

According to Europol’s press
release^[1], authorities also
executed search warrants in June this year against the developer
and an employee of IM-RAT in Australia and Belgium, likely with an
aim to identify re-sellers and users of the tool.

Moreover, 13 of the most prolific customers of IM-RAT were also
arrested in Australia, Colombia, Czechia, the Netherlands, Poland,
Spain, Sweden, and the United Kingdom.

Once installed, IM-RAT gives attackers full control over
victims’ computers, allowing them to carry out various malicious
actions, listed below, without the victims’ knowledge:

• recording keystrokes,
• stealing data and passwords from browsers,
• spying on victims via their webcams,
• download/execute files,
• disabling anti-virus and anti-malware software,
• terminate running processes,
• and perform dozens of other actions.

IM-RAT was considered to be a dangerous threat due to its
features, ease of use, and low cost of as little as $25 with
lifetime access.

“The global law enforcement cooperation we have seen in this
case is integral to tackling criminal groups who develop such
tools. It is also important to remember that some basic steps can
prevent you from falling victim to such spyware: we continue to
urge the public to ensure their operating systems and security
software are up to date.”

The law enforcement believes that the number of IM-RAT victims
falls in tens of thousands, with “investigators having already
identified evidence of stolen personal details, passwords, private
photographs, video footage, and data.”

In a similar joint operation by International law enforcement
agencies, the cybercrime network of another remote access Trojan,
called Luminosity
Link^[2], was also dismantled two
years ago.

In Luminosity Link case, a 21-year-old developer of the tool was
arrested and
sentenced^[3] to 30 months in prison
for his role in unlawfully accessing computers, money laundering,
and illegal removal of property to prevent its lawful seizure.

To avoid falling victims to such threats, individual users and
organizations are recommended to follow some necessary measures,
such as keeping all your software up-to-date, configuring a
firewall correctly, avoid opening suspicious email attachments or
URLs, and always using strong, unique passwords for different
online accounts.