Police arrest 2 in connection with CyberSeal, Dataprotector crime services

It’s another move by law enforcement agencies to strike at the heart of cybercriminal infrastructure.

Romanian police have arrested two people for allegedly distributing malicious software designed to evade anti-virus protections to more than 1,560 accused cybercriminals, Europol, the European Union’s law enforcement agency, said Friday.

The international crackdown, which Europol and the FBI supported, targeted a decade-long scheme that provided crooks with relatively cheap access to victim computers, which they used to carry out information-stealing and ransomware attacks.

The two Romanian suspects, whom authorities did not identify, allegedly ran “crypting” services designed to sneak malicious code past anti-virus software. The services, dubbed CyberSeal and Dataprotector, sold for between $40 to $300, according to Europol. The two suspects also allegedly offered cybercriminals access to a platform to test their malware against anti-virus software for as little as $7.

It’s the latest effort by global law enforcement agencies to strike at the heart of infrastructure used by people accused of facilitating costly hacking schemes. Europol and Australian police in December 2019 announced the takedown of a remote-access hacking tool that had been sold to 14,500 buyers in 124 countries. In October, U.S. and European law enforcement announced arrests of 14 people who allegedly worked for QQAAZZ, an Eastern European group accused of trying to launder tens of millions of dollars.

In addition to the two arrests this week, law enforcement agencies in Romania, Norway and the U.S. seized computing infrastructure allegedly used by a suspect, according to Europol which credited the FBI for helping. An FBI spokesperson did not immediately respond to a request for comment on the bureau’s role in the operation.

The Directorate for Investigating Organized Crime and Terrorism, one of Romania’s top law enforcement agencies, posted a video that appeared to show armed police raiding one of the suspect’s homes and searching laptops.

At press time, the websites distributing two of the malicious services had been taken down.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Technology

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems