He, his buyers took over many computers undetected. Now, Lexington hacker faces prison.

Getty Images/iStockphoto

A Central Kentucky man pleaded guilty Monday to being part of a conspiracy that used software to get full remote control of victims’ computers.

Colton Grubbs, 21, of Lexington pleaded guilty to charges of conspiracy to defraud, obstruction of justice, and conspiracy to money laundering. Grubbs was the owner and operator of a company called Luminosity Security Solutions. The company sold a hacking tool that allowed cybercriminals to remotely and surreptitiously gain complete control over a person’s computer.

Once installed on a victim’s computer, a user of LuminosityLink was free to access and view documents, photographs and other files, record all keystrokes entered and even activate the victim’s webcam. All of that unauthorized and undetected access could be done without the victim’s knowledge.

Victims were believed to be in the thousands, and investigators in Europe found evidence of stolen personal details, passwords, private photographs, video footage and data.

Grubbs was indicted in June for crimes that allegedly happened in Fayette and Lincoln counties. At the time the federal investigation began, Grubbs lived in Stanford but he later moved to Lexington.

He also pleaded guilty to one count of removal of property to prevent seizure.

On July 10, 2017, after learning the FBI was about to search his Lexington apartment, Grubbs gave his laptop to his roommate and asked him to conceal it in the roommate’s car, according to court records.

Grubbs also hid a debit card associated with his bitcoin account and hid a phone storing his bitcoin information in his roommate’s closet, the plea agreement says.

Grubbs removed the hard drives from his desktop computer and took them from his apartment so they would not be seized by the government, the plea agreement says. Three days later, he transferred more than 114 bitcoin into six new bitcoin addresses.

The charges of conspiracy to defraud and obstruction of justice each carry penalties of up to five years in prison, a fine up to $250,000, and up to three years of supervised release. The money-laundering count is punishable by up to 20 years in prison, up to a $500,000 fine, and up to three years of supervised release.

Seven other counts of the indictment will be dismissed at sentencing.

U.S. District Judge Joseph M. Hood scheduled sentencing for Oct. 15.

Did you get a notice that says your personal information was exposed in a data breach? Visit to learn what you can do to protect your identity.

Related stories from Lexington Herald Leader