Police have arrested two Romanians for allegedly helping hackers refine their malware attacks to beat antivirus software.
On Friday, Europol announced it had nabbed the two suspects for running Cyberseal and Dataprotector, a pair of online services capable of encrypting the computer code in malware, making the processes harder to detect.
“These services have been purchased by more than 1,560 criminals and used for crypting several different types of malware, including Remote Access Trojans, information stealers and ransomware,” the European law enforcement agency said.
By buying the services, the hackers were able to hide and embed their malware attacks in legitimate software, which could then be circulated to unsuspecting internet users. The site for Cyberseal also contained helpful video tutorials and offered customer support, enabling novice hackers to use the service too.
On top of all this, the Romanians allegedly ran Cyberscan, which could let clients test their malware strains against antivirus software. According to Europol, the arrested Romanians had been offering their services to the cybercriminal underground since 2010.
“Their clients paid between US$40 to US$300 for these crypting services, depending on licence conditions,” the agency added. To test the malware against antivirus tools through Cyberscan, the Romanians charged between $7 and $40.
Romanian authorities add that the services helped improve as many as 3,000 malware files, which were then used to launch cyber attacks across the globe.
European investigators and the FBI worked together to take down the servers running the malware-refining services. As a result, the website for Cyberseal is now offline. In addition, police in Romania conducted four house searches in Bucharest and Craiova, where the suspects lived.