The FBI used a booby-trapped image laced with malware to catch a Californian man who has now been charged for his alleged role in threatening to target multiple US high schools and for using cyber-extortion tactics to blackmail victims and produce child pornography.
Buster Hernandez, 26, was charged with threats to use an explosive device, threats to injure and sexual exploitation of a child less than 12 years of age, the Department of Justice (DoJ) said.
FBI investigators were brought into the case back in December 2015, asked to help locate a mysterious online criminal posing online under the name "Brian Kil" with the help of special anonymising software.
He would use multiple Facebook accounts - via the Tor network - to demand explicit images from minors.
Hernandez now stands accused of "sextorting" a number of victims in at least 10 federal districts, while making sick threats against them if they failed to send him illicit material against their will.
Ultimately, the Feds were able to deploy a stealthy network investigative technique (NIT) to bring him to justice.
It was on 9 June 2017 when authorities authorised the use of the NIT to locate the culprit's IP address after years of investigative work. They added a "small piece of code" to a video file [...] which did not contain any visual depictions of [...] sexually explicit material," the filing stated.
When "Kil" – allegedly Hernandez – viewed the video file containing the malware it disclosed key information about his computer. After receiving the video, he then "began sending messages to the family of [the victim']" stating that he was going to murder her family members.
He sent an image that showed a sharp knife. On 22 July, the legal filing states that the IP address under surveillance was used to browse 4Chan, eventually landing on a photograph of the Columbine killers in a school. "Brian Kil", it emerged, had previously sent this image to a victim.
"The FBI told us that this would be a long investigation and they were right," said Plainfield police chief Darel Krieger in a statement. "However, with dogged determination they have apprehended a person who they believe is the person who posed as Brian Kil," he added.
"We are grateful not only to the FBI but to all the agencies involved in this investigation (federal state and local) and the great partnership that was shown over the past 20 months."
The "Brian Kill" account reportedly made numerous violent threats towards the victims, with evidence indicating he had been active online since at least 2014.
One threat in the filing read: "I'm coming for you [name redacted]. You're f**king dead you slutty bitch. I will slaughter your entire class and save you for last. I will lean over as you scream and cry and beg for mercy right before I slit your f**king throat ear to ear."
There were many others, just as harrowing.
"This was a unique and complex investigation that highlights the tenacity, perseverance, expertise and dedication of the FBI Indianapolis' Crimes against Children Task Force and was a top priority," said W. Jay Abbott, special agent in charge of the FBI's Indianapolis Division.
"Innovative techniques were utilised. I stood in front of concerned parents and community members and told them we would find the person who had been victimising these young girls and, with the tireless work of our agents and partners, we never gave up."
Hernandez now faces a mandatory minimum sentence of 15 years' imprisonment, and a maximum of 30 years' imprisonment if convicted on all counts.