SubSeven

SubSeven — Sub7 to everyone who used it — was released on 28 February 1999 by someone using the handle mobman. It landed a year after NetBus into a scene that already understood the premise, and it won that scene by simply doing more: webcam capture, port redirection, a registry editor, chat. Security experts usually describe it as a trojan horse, and mobman himself called SubSeven a clone of Back Orifice. The security researcher Steve Gibson put the reality of having it on your machine plainly: anyone with it installed "might as well have the hacker standing right next to them."

What made it era-defining was how ordinary the delivery was. It travelled as a file someone talked you into opening, and it kept travelling that way for years — as late as 2003, someone was pushing it through a Spanish-language email dressed up as a message from the security firm Symantec, which is a fair summary of the whole trick: the thing that took your computer arrived looking like a favour.

Mobman's own development ended with version 2.1.5, "SubSeven Legends," in 2003. The identity behind the handle never resolved. Rolling Stone identified mobman as an American man in a 2013 article, and that stood largely unchallenged for over a decade — until an October 2024 episode of the podcast Darknet Diaries, in which a man claiming to be the real mobman, Romanian and living in Canada, confronted the American and pointed to holes in his account, including that the first version of Sub7 carried the line "From Windsor, Ontario" — a place the American said he had never been. Nobody has settled it. Sub7 still has no confirmed author, which is either a failure of the record or the most fitting ending available.

One footnote worth killing: the story that "SubSeven" is NetBus spelled backwards, with ten swapped for seven, gets repeated everywhere. It appeared on Wikipedia for years without a single citation and has since been removed. It is a lovely piece of folklore and there is no evidence for it.