Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/17/2018
05:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Federal Jury Convicts Operator of Massive Counter-Antivirus Service

Scan4You helped thousands of criminals check if AV products could detect and block their malware tools.

A federal jury in Virginia has convicted Latvian resident Ruslans Bondars on charges related to his operation of Scan4You, one of the largest counter-antivirus (CAV) services in the cyber underground before it was shut down in 2016.

After a five-day trial, the jury found Bondars guilty of felony hacking, wire fraud, and other charges connected with operating the service, which offered threat actors a way to check if their malware was detectable by antivirus tools. At least 30,000 people used the illegitimate service to vet their malware before distribution during the period Scan4You was operational, between 2009 and 2016.

Among the many criminal hackers that used Scan4You to test and improve their malware was the group behind the Target breach that exposed data on more than 40 million credit cards in addition to nearly 70 million email addresses. Another threat actor used Scan4You to assist in the development of the widely distributed Citadel Trojan, which infected more than 11 million computers worldwide and resulted in some $500 million in fraud losses, the US Department of Justice said in a statement.

Russian national Jurijs Martisevs, an individual who assisted Bondars in operating Scan4You, pleaded guilty to his role in March and is awaiting sentencing. Both men were arrested last year in Latvia and extradited to the US amid protests by Russia that Martisevs' arrest was actually a kidnapping.

"At its height, Scan4You was one of the largest services of its kind and had at least thousands of users," the DOJ said in its statement this week. "Malware developed with the assistance of Scan4You included some of the most prolific malware known to the FBI and was used in major computer intrusions committed against American businesses."

Security vendor Trend Micro, which played a major role in helping law enforcement take down Scan4You, has described it as the first widely available CAV service that criminals could use to test their malware against modern antivirus tools.  

The service allowed almost anyone to submit a malicious file and verify if antimalware tools would flag it as malicious. Malware authors used the service to scan millions of files, including keyloggers, remote access Trojans, crypters, and entire malware tool kits.

Unlike legitimate malware-scanning services, which share scanning results with the broader community, Scan4You provided the results of its scans only to the individual submitting the file. Bondars and Martisevs offered up to 100,000 scans per month for just $30, with acceptable forms of payment including PayPal, Bitcoin, and WebMoney. Trend Micro estimates that, at its peak, Scan4You earned its operators some $15,000 a month.

Prior to Scan4You's launch in 2009, such anonymous scanning services where only available privately within the most organized of criminal enterprises, says a security analyst at Trend Micro who did not wish to be identified.

Examples of groups that used such services privately include Rove Digital, an Estonian click-fraud gang, and the Mevade group from Israel and Ukraine. "Scan4You made such a service available to the masses — greatly increasing the effectiveness of their malware attacks," the security analyst says.

Over the years, other CAV providers, including resellers of Scan4You services, have popped up, but they haven't been quite as successful. The biggest remaining CAV service is VirusCheckMate, an operation that doesn't appear to have benefited a whole lot from Scan4You's takedown, says the Trend Micro analyst.

One reason could be the relative complexity and low payoffs from operating a CAV service. "To run a CAV service is quite technically challenging, as you need to maintain a separate virtual machine for each of the AV products that your service supports," the analyst says.

"So, if a CAV allowed scanning with 30 AV scanners, that is 30 different virtual machines to maintain." Each of those machines would need to be both constantly up to date with the latest malware definitions and also disabled from sending feedback to the vendors in question, the Trend Micro security analyst notes. CAV operators also need to create code for automating the malware submission process and for retrieving the results out of custom security software logs.

"Being operators of Scan4You was likely quite prestigious in cybercrime circles" for Bondars and Martisevs, which explains why they persisted with the operation for eight years, the analyst says. The pair also was involved with other malicious services and groups—most notably Eva Pharmacy, one of the oldest and largest pharmaceutical spam gangs—which likely also brought in money.

For the moment, it is unclear why cybercriminals that were using Scan4You have not yet migrated to other CAV services like VirusCheckMate. "But this is a welcome trend," the Trend Micro analyst says.

One big hope is that the Scan4You takedown has had a deterrent effect on cybercriminals and will force them to either maintain their own private CAV service or to release their malware without testing. "All of those outcomes drive up the cost of doing business for cybercriminal operators," the analyst says.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Tough Love: Debunking Myths about DevOps & Security
Jeff Williams, CTO, Contrast Security,  8/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5638
PUBLISHED: 2019-08-21
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user accou...
CVE-2019-6177
PUBLISHED: 2019-08-21
A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to Le...
CVE-2019-10687
PUBLISHED: 2019-08-21
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
CVE-2019-11601
PUBLISHED: 2019-08-21
A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.
CVE-2019-11602
PUBLISHED: 2019-08-21
Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.