Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/17/2018
05:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Federal Jury Convicts Operator of Massive Counter-Antivirus Service

Scan4You helped thousands of criminals check if AV products could detect and block their malware tools.

A federal jury in Virginia has convicted Latvian resident Ruslans Bondars on charges related to his operation of Scan4You, one of the largest counter-antivirus (CAV) services in the cyber underground before it was shut down in 2016.

After a five-day trial, the jury found Bondars guilty of felony hacking, wire fraud, and other charges connected with operating the service, which offered threat actors a way to check if their malware was detectable by antivirus tools. At least 30,000 people used the illegitimate service to vet their malware before distribution during the period Scan4You was operational, between 2009 and 2016.

Among the many criminal hackers that used Scan4You to test and improve their malware was the group behind the Target breach that exposed data on more than 40 million credit cards in addition to nearly 70 million email addresses. Another threat actor used Scan4You to assist in the development of the widely distributed Citadel Trojan, which infected more than 11 million computers worldwide and resulted in some $500 million in fraud losses, the US Department of Justice said in a statement.

Russian national Jurijs Martisevs, an individual who assisted Bondars in operating Scan4You, pleaded guilty to his role in March and is awaiting sentencing. Both men were arrested last year in Latvia and extradited to the US amid protests by Russia that Martisevs' arrest was actually a kidnapping.

"At its height, Scan4You was one of the largest services of its kind and had at least thousands of users," the DOJ said in its statement this week. "Malware developed with the assistance of Scan4You included some of the most prolific malware known to the FBI and was used in major computer intrusions committed against American businesses."

Security vendor Trend Micro, which played a major role in helping law enforcement take down Scan4You, has described it as the first widely available CAV service that criminals could use to test their malware against modern antivirus tools.  

The service allowed almost anyone to submit a malicious file and verify if antimalware tools would flag it as malicious. Malware authors used the service to scan millions of files, including keyloggers, remote access Trojans, crypters, and entire malware tool kits.

Unlike legitimate malware-scanning services, which share scanning results with the broader community, Scan4You provided the results of its scans only to the individual submitting the file. Bondars and Martisevs offered up to 100,000 scans per month for just $30, with acceptable forms of payment including PayPal, Bitcoin, and WebMoney. Trend Micro estimates that, at its peak, Scan4You earned its operators some $15,000 a month.

Prior to Scan4You's launch in 2009, such anonymous scanning services where only available privately within the most organized of criminal enterprises, says a security analyst at Trend Micro who did not wish to be identified.

Examples of groups that used such services privately include Rove Digital, an Estonian click-fraud gang, and the Mevade group from Israel and Ukraine. "Scan4You made such a service available to the masses — greatly increasing the effectiveness of their malware attacks," the security analyst says.

Over the years, other CAV providers, including resellers of Scan4You services, have popped up, but they haven't been quite as successful. The biggest remaining CAV service is VirusCheckMate, an operation that doesn't appear to have benefited a whole lot from Scan4You's takedown, says the Trend Micro analyst.

One reason could be the relative complexity and low payoffs from operating a CAV service. "To run a CAV service is quite technically challenging, as you need to maintain a separate virtual machine for each of the AV products that your service supports," the analyst says.

"So, if a CAV allowed scanning with 30 AV scanners, that is 30 different virtual machines to maintain." Each of those machines would need to be both constantly up to date with the latest malware definitions and also disabled from sending feedback to the vendors in question, the Trend Micro security analyst notes. CAV operators also need to create code for automating the malware submission process and for retrieving the results out of custom security software logs.

"Being operators of Scan4You was likely quite prestigious in cybercrime circles" for Bondars and Martisevs, which explains why they persisted with the operation for eight years, the analyst says. The pair also was involved with other malicious services and groups—most notably Eva Pharmacy, one of the oldest and largest pharmaceutical spam gangs—which likely also brought in money.

For the moment, it is unclear why cybercriminals that were using Scan4You have not yet migrated to other CAV services like VirusCheckMate. "But this is a welcome trend," the Trend Micro analyst says.

One big hope is that the Scan4You takedown has had a deterrent effect on cybercriminals and will force them to either maintain their own private CAV service or to release their malware without testing. "All of those outcomes drive up the cost of doing business for cybercriminal operators," the analyst says.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-0324
PUBLISHED: 2021-06-14
Product: AndroidVersions: Android SoCAndroid ID: A-175402462
CVE-2021-0467
PUBLISHED: 2021-06-14
In Chromecast bootROM, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege in the bootloader, with physical USB access, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Andr...
CVE-2021-21554
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS contain a stack-based buffer overflow vulnerability in systems with Intel Optane DC Persistent Memory installed. A local malicious user with high privileges may potentially exploit t...
CVE-2021-21555
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, a...
CVE-2021-21556
PUBLISHED: 2021-06-14
Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, ...