The Washington post has an article[1] talking about this. It looks like the FBI did some digging to come up with the charges. Counts 2 through 4 are related to
violations of 18 U.S.C. 2512 [2] which criminalizes making, selling, or advertising for sale illegal wiretapping devices. That's pretty interesting because as far as I know it would be a first to categorize malware as such a "device".
[1] https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...