For the past four years, an Italian company has been operating a seemingly legitimate website and business, offering reverse engineering protection services for Windows applications, but has secretly advertised and provided its service to malware gangs.
The company's secret operation came to light when security researchers from Check Point began looking into GuLoader [1, 2, 3], a new malware strain that became one of the most active malware operations of 2020.
Check Point says it found references in the GuLoader code to CloudEyE Protector, an anti-reverse engineering software service provided by an Italian company called CloudEyE.
However, while source code protection services are legal and widely used, by almost all commercial/legitimate applications, Check Point said it linked this company and its owners to activities on hacking forums dating back years.
Check Point linked the CloudEyE binary protection service advertised on the securitycode.eu website with ads promoting a malware encryption service called DarkEyE, which has been heavily advertised on hacking forums since 2014.
In addition, Check Point also linked three usernames and emails used to promote DarkEyE to the real identity of one of CloudEyE's founders, as displayed on the CloudEyE website.
Additionally, Check Point says it spotted these three email addresses and usernames in multiple posts on hacking forums.
The posts were advertising malware/binary encryption services even before DarkEyE and started as early as 2011, showing how well-established and well-connected this user was in the cybercrime and malware community.
These connections apparently helped the group launch its legitimate business. Check Point reports that CloudEyE boasts of having more than 5,000 customers on their website.
Based on the minimum rate of $100/month, Check Point says the team made at least $500,000 from their service. However, the amount could be much higher considering that some monthly plans can go as high as $750/month and some customers likely used the service for multiple months.
All indications point to the fact that the two CloudEyE operators attempted to legalize their criminal operation by hiding it behind a front company as a way to justify their profits and avoid suspicion from local tax authorities when cashing out their huge winnings .
“CloudEyE operations may appear legitimate, but the service provided by CloudEyE has been a common denominator in thousands of attacks over the past year,” Check Point said.
