It looks like DOJ is trying to make an example out of some lowly frontend/freelance developer. Her work includes:
- creating a "web panel used to access victim data stored in a database"
- added a feature that "showed an infected computer or ‘bot’ status in different colors based on the colors of a traffic light"
- added a feature that "allowed other Trickbot Group members to know when their co-conspirators were working on a particular infected machine"
One thing DOJ accuses her of is "developing tools and protocols for the storage of credentials stolen and exfiltrated from victims infected by Trickbot." But its pretty obvious they don't know what "frontend developer" even means.