View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
November 29, 2019

RAT Bought by 14,500 People Taken Down in International Operation

"A complex, challenging cyber investigation with international scope"

By CBR Staff Writer

The UK’s National Crime Agency (NCA) says it has taken down a website which sold a hacking tool called IM RAT bought by cyber criminals in 124 countries, in a global operation led from Australia that resulted in 14 arrests and the seizure of more than 400 items.

Some 14,500 people across the world bought the Imminent Monitor Remote Access Trojan (IM RAT) from https://imminentmethods.net for as little as US$25, the NCA said today.

The RAT granted users full access to the infected device, enabling them to disable anti-virus software, steal data or passwords, record key strokes and watch victims via their webcams. The international operation was led by the Australian Federal Police (AFP), but appears to have led to a majority of arrests being in the UK (nine, out of the 14 globally).

ROCU officer on computer

Fourteen search warrants were executed across the UK, in Greater Manchester, Merseyside, Milton Keynes, Hull, London, Leeds, Walsall, Lancashire, Nottingham, Surrey, Essex and Somerset.

The warrants led to nine arrests and the recovery of 100 “exhibits.”

Australian police led a takedown of https://imminentmethods.net on the morning of Friday 29 November, the NCA said, dismantling the IM RAT toolkit in the process: the malware can no longer be used by its buyers.

Content from our partners
How businesses can safeguard themselves on the cyber frontline
How hackers’ tactics are evolving in an increasingly complex landscape
Green for go: Transforming trade in the UK

Phil Larratt from the NCA’s National Cyber Crime Unit said: “Working with the NWROCU, AFP and a range of international and European partners we were able to support the takedown of a website that was distributing malware and facilitating hacking offences”

IM RAT “Used By Organised Crime Groups”

“The IM RAT was used by individuals and organised crime groups in the UK to commit a range of offences beyond just the Computer Misuse Act, including fraud, theft and voyeurism. Cyber criminals who bought this tool for as little as US$25 were able to commit serious criminality, remotely invading the privacy of unsuspecting victims and stealing sensitive data”.

Detective Inspector Andy Milligan from Australia’s NWROCU said: “This has been a complex, challenging cyber investigation with international scope. We have been supported throughout by the AFP, the NCA and our partners in Europol and Eurojust.  The UK’s Regional Organised Crime Unit (ROCU) network and Force Specialist Cyber Crime Units were pivotal during this phase of enforcement activity.

“The illicit use of IM RAT is akin to a cyber burglary, with criminals stealing data, including images and movies, secretly turning on web cams, monitoring key strokes and listening in to people’s conversations via computer microphones. Cyber Crime is not an anonymous victimless crime as some believe. There are real world consequences to people’s actions in cyber space and the international activity this week has shown how serious the UK treats this sort of criminality.”

Read this: UK Police Conduct Fresh Wave of DDoS Raids

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how New Statesman Media Group may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.
THANK YOU