Loading story…
Colton Ray Grubbs, a Kentucky man accused of creating and selling the LuminosityLink remote access trojan, pleaded guilty to authoring, marketing, and distributing malware that prosecutors said enabled unauthorized access to victims’ computers. Sold from 2015 through online forums under the alias "KFC Watermelon," LuminosityLink was promoted as a remote administration tool but was widely used to steal information, log keystrokes, disable security software, and activate webcams. Prosecutors said Grubbs also tried to conceal evidence before an FBI raid by removing hard drives and moving more than 114 bitcoin to new addresses.
The plea followed broader international enforcement and industry tracking of LuminosityLink’s spread. Europol said the malware had been sold to more than 8,600 customers and used against tens of thousands of computers across 78 countries, while Palo Alto Networks researchers previously analyzed the malware’s encrypted configuration and extracted data from roughly 14,700 samples out of nearly 18,000 collected. That research tied LuminosityLink to about 50,000 attempted infections observed against customers and documented its use as a full-featured backdoor with configurable command-and-control domains, ports, and surveillance capabilities.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
Three days after learning of the planned FBI search, Grubbs transferred more than 114 bitcoin from his LuminosityLink bitcoin address into six new bitcoin addresses, according to the plea agreement.
According to the plea agreement, on July 10, 2017, Grubbs learned the FBI was about to raid his apartment and hid the phone and debit card tied to his Bitcoin account while removing hard drives from his computer and apartment.
By mid-2017, Europol said LuminosityLink had been sold to more than 8,600 customers and used against tens of thousands of computers across 78 countries.
Federal prosecutors said Colton Ray Grubbs began selling the LuminosityLink remote access tool in May 2015 under the alias "KFC Watermelon," marketing it via Hackforums.net for $40.
Colton Ray Grubbs pleaded guilty to conspiring to author, market, and distribute LuminosityLink and to knowingly assisting customers in using it to break into computers and steal information.
A Palo Alto Networks blog post linked the Skype account associated with "KFC Watermelon" to an email address tied to earlier RAT-related domain registrations, connecting LuminosityLink's operator to prior malware infrastructure.
Palo Alto Networks released research detailing how LuminosityLink stores and encrypts its configuration and reported extracting configurations from thousands of samples. The company also said it had observed about 50,000 attempted infections against its customers and was detecting related malware, domains, and C2 traffic.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 34 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
krebsonsecurity.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceeuropol.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice said it seized domains tied to a major information-stealing malware operation involving **Lumma Stealer**, disrupting command-and-control infrastructure and associated marketplaces. Trend Micro and TrendAI reported that the malware-as-a-service operation suffered a short-lived drop in activity after roughly **2,300 malicious domains** were taken down, but victim-account targeting recovered within weeks and returned to typical levels by June and July 2025. Researchers said Lumma operators quickly adapted by moving infrastructure away from heavy **Cloudflare** reliance to other providers, including Russia-based **Selectel**, and by expanding covert delivery methods. Campaigns distributing Lumma used **AI-assisted fake GitHub repositories**, fake crack and keygen sites, **ClickFix** fake CAPTCHA lures, and social media promotion to push loaders such as **SmartLoader** and the stealer itself. TrendAI also cited a developer claim that authorities accessed and wiped servers through a suspected **iDRAC** vulnerability before the operators restored access and disabled the exposed remote-management interface.
Aug 21, 2026
A U.S. federal jury convicted Russian national **Oleg Koshkin** for operating malware crypter services that helped the **Kelihos** botnet evade antivirus detection and spread malicious payloads. Prosecutors said Koshkin ran sites including **Crypt4U.com**, **Crypt4U.net**, **fud.bz**, and **fud.re**, advertising tools that made malware such as botnets, RATs, keyloggers, stealers, crypto miners, and ransomware fully undetectable. Court evidence showed Kelihos operator **Peter Levashov** paid roughly **$3,000 per month** from 2014 to 2017 for custom high-volume re-crypting, while co-defendant **Pavel Tsurkan** pleaded guilty to aiding malware infections worldwide, including ransomware attacks. The conviction builds on the broader U.S. campaign against Kelihos, a botnet active since at least 2010 that at various points controlled **60,000 to more than 100,000 compromised Windows computers**. Authorities said the botnet was used for spam, credential theft, pump-and-dump stock fraud, denial-of-service activity, and malware distribution before the FBI and partners including **CrowdStrike** and the **Shadowserver Foundation** disrupted it through a sinkholing operation and Levashov’s arrest in Spain. Investigators linked Levashov to the infrastructure through IP and account records, with reporting noting operational security mistakes such as reused credentials that helped expose him.
Aug 15, 2026
An international law enforcement operation disrupted the **Imminent Monitor** remote access trojan (RAT), a malware tool marketed online as legitimate remote administration software but widely used for cybercrime. Researchers at Palo Alto Networks Unit 42 said they collected more than **65,000** samples and observed over **115,000** attacks tied to the malware, which included stealth and persistence features, antivirus-evasion tooling, hidden keylogging, and later cryptocurrency-mining capability. Investigators linked the malware’s developer, known as **"Shockwave™"**, to Australia and referred the case to the Australian Federal Police, which worked with partners including the FBI and Canada’s CRTC to support **Operation Cepheus** and disable the RAT’s licensing infrastructure. The takedown exposed purchaser records and triggered enforcement against suspected users, with authorities reporting **85 warrants**, **434 device seizures**, and **13 arrests**. In the UK, that investigation led to the conviction of **Scott Cowley** of St Helens, Merseyside, who was sentenced to two years in prison after forensic analysis found he had used Imminent Monitor to hijack the webcams of three women and secretly record them in their bedrooms. The case underscored how a commodity RAT sold to thousands of customers was used not only for intrusion and surveillance, but also for sexual abuse and other criminal activity.
Aug 15, 2026