Morgan Culbertson, a former engineering student at Carnegie Mellon University (CMU), pleaded guilty Tuesday in a Pittsburgh federal court to developing and marketing malware capable of remotely controlling Android phones, including enlisting the phones' cameras to spy on owners, reports indicated.
The 20-year-old interned as an anti-malware professional at FireEye. Concurrently, known on the underground forum Darkode as “Android,” he peddled Dendroid, a remote access trojan (RAT), for $300.
Culbertson, who faces 10 years in prison and a fine of up to $250,000 for conspiracy to damage protected computers when he is sentenced in December, was among some 70 people worldwide targeted in "Operation Shrouded Horizon," a two-year-long undercover operation targeting Darkode led by the FBI and Department of Justice in collaboration with law enforcement agencies in 20 countries.
He has taken leave from CMU and remains free on a $10,000 bond.
