The criminals are suspected of developing and using CyberSeal, DataProtector and CyberScan services.
Romanian police have arrested two people suspected of creating and using three online services designed to help develop and distribute malware. The arrests are part of a joint operation by the FBI, Europol, Australian and Norwegian police.
According to investigators, the suspects are the authors of three services - CyberSeal, DataProtector and CyberScan. The first two are so-called "cryptographic" services that allow developers to encrypt their malware code in order to bypass anti-virus software and avoid detection. The third service, CyberScan, acted as a clone of the VirusTotal service. It allowed malware authors to download and scan their software and check if they could be detected by antivirus solutions.
The difference between CyberScan and VirusTotal was that CyberScan did not share scan results with antivirus vendors, allowing malware authors to validate their solutions without fear of being sent back to the security software company with a "detection alert".
The suspects have been involved in criminal malware distribution activities since at least 2014, when they first started advertising CyberSeal. The other two services were launched in 2015 (DataProtector) and 2019 (CyberScan). All three services have been advertised on several hacking forums for prices ranging from $ 40 to $ 150.
According to Europol representatives, these tools were often used to encrypt and test various types of malware, such as RAT, info-stealers and ransomware.
Investigators have shut down servers in Romania, Norway and the United States. The cyber-seal.org and cyberscan.org domains used to host the two services are now disabled.
__________________
Romanian police have arrested two people suspected of creating and using three online services designed to help develop and distribute malware. The arrests are part of a joint operation by the FBI, Europol, Australian and Norwegian police.
According to investigators, the suspects are the authors of three services - CyberSeal, DataProtector and CyberScan. The first two are so-called "cryptographic" services that allow developers to encrypt their malware code in order to bypass anti-virus software and avoid detection. The third service, CyberScan, acted as a clone of the VirusTotal service. It allowed malware authors to download and scan their software and check if they could be detected by antivirus solutions.
The difference between CyberScan and VirusTotal was that CyberScan did not share scan results with antivirus vendors, allowing malware authors to validate their solutions without fear of being sent back to the security software company with a "detection alert".
The suspects have been involved in criminal malware distribution activities since at least 2014, when they first started advertising CyberSeal. The other two services were launched in 2015 (DataProtector) and 2019 (CyberScan). All three services have been advertised on several hacking forums for prices ranging from $ 40 to $ 150.
According to Europol representatives, these tools were often used to encrypt and test various types of malware, such as RAT, info-stealers and ransomware.
Investigators have shut down servers in Romania, Norway and the United States. The cyber-seal.org and cyberscan.org domains used to host the two services are now disabled.
__________________