Suspected Agobot Trojan author arrested in Germany, Sophos comments

May 12, 2004 Sophos Press Release

According to media reports, a 21-year-old German man was arrested and charged under the country's computer sabotage law for creating malicious computer code. Admitting responsibility for creating the Agobot Trojan, the suspect was apprehended in the southern town of Waldshut on Friday 7 May.

The suspect's computer hardware and software were also confiscated and will be closely examined by the authorities. Five other Germans were also charged in connection with the distribution of these Trojan programs.

"The Agobot family of Trojans is huge, with variants allowing unauthorised and remote access to a infected computer," said Carole Theriault, security consultant at Sophos. "The first version of this Trojan is almost 20 months old, and we hope that with these arrests, we'll be seeing the last of them."

"However, it is difficult to confirm at this time whether this suspect is the author of all the Agobot variants. The code was reportedly available online, and in that case, anybody could have downloaded it, tweaked it and distributed a version of it," explained Theriault.

German authorities told reporters that there was no link between this arrest and the arrest of Sven Jaschan, the 18-year-old German from Rotenburg in northern Germany, who was charged late last week in connection with the Sasser worm.