#pentest | #cissp | CyberSeal arrests: Malware code encryption suspects apprehended in Romania



John Leyden

20 November 2020 at 15:21 UTC

Updated: 20 November 2020 at 15:27 UTC

All crypting kingpins cuffed

Romanian police have arrested a pair of suspected cybercriminals who allegedly made a fortune running a malware encryption service that helped cybercriminals bypass antivirus defenses.

The unnamed duo are suspected of running the CyberSeal and Dataprotector ‘crypting’ services that were said to be used by more than 1,500 criminals to develop remote access trojans (RATs), information stealers, and ransomware.

Malware writers use crypting services to disguise their malicious software as something benign.

Encryption-as-a-Service

These illicit crypting services – in operation since 2010 – charged their clients between $40 to $300, depending on license conditions.

“[The] service activity was well structured and offered regular updates and customer support to the clients,” according to a statement by investigators at European policing body Europol.

Catch up with the latest cybercrime news

The same pair of suspects also operated a service which allowed their clients to test their malware against antivirus tools.

The prices for this service, branded as Cyberscan, varied between $7 to $40.

Such services are touted in underground markets as offering fully undetectable (FUD) capability but, in practice, what crooks are buying is a longer shelf life for their malicious code.

How do crypters work? (Image courtesy of Europol)

Backend infrastructure takedown

An investigation led by the Romanian Police (Poliția Română) resulted in four house searches carried out in the cities of Bucharest and Craiova, two arrests, and the dismantling of backend infrastructure linked to the illicit services in Romania, Norway, and the US.

The FBI, the Australian Federal Police, the Norwegian National Criminal Investigation Service (Kripos) and Europol each assisted in Operation Invoke.

The Europol statement explains its role in offering forensic, malware, and operational analysis in the early part of the operation as well as a “virtual command post” on the day’s homes were raided, and attack infrastructure was seized.

RELATED Europol campaign urges e-commerce retailers to #SellSafe this Black Friday



Click here to go to the original Source of this story.

______________________________________________________________________________________________

Get your CompTIA A+, Network+ White Hat-Hacker, Certified Web Intelligence Analyst and more starting at $35 a month. Click here for more details.

Leave a Reply