Attacks/Breaches

5/17/2018
05:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Federal Jury Convicts Operator of Massive Counter-Antivirus Service

Scan4You helped thousands of criminals check if AV products could detect and block their malware tools.

A federal jury in Virginia has convicted Latvian resident Ruslans Bondars on charges related to his operation of Scan4You, one of the largest counter-antivirus (CAV) services in the cyber underground before it was shut down in 2016.

After a five-day trial, the jury found Bondars guilty of felony hacking, wire fraud, and other charges connected with operating the service, which offered threat actors a way to check if their malware was detectable by antivirus tools. At least 30,000 people used the illegitimate service to vet their malware before distribution during the period Scan4You was operational, between 2009 and 2016.

Among the many criminal hackers that used Scan4You to test and improve their malware was the group behind the Target breach that exposed data on more than 40 million credit cards in addition to nearly 70 million email addresses. Another threat actor used Scan4You to assist in the development of the widely distributed Citadel Trojan, which infected more than 11 million computers worldwide and resulted in some $500 million in fraud losses, the US Department of Justice said in a statement.

Russian national Jurijs Martisevs, an individual who assisted Bondars in operating Scan4You, pleaded guilty to his role in March and is awaiting sentencing. Both men were arrested last year in Latvia and extradited to the US amid protests by Russia that Martisevs' arrest was actually a kidnapping.

"At its height, Scan4You was one of the largest services of its kind and had at least thousands of users," the DOJ said in its statement this week. "Malware developed with the assistance of Scan4You included some of the most prolific malware known to the FBI and was used in major computer intrusions committed against American businesses."

Security vendor Trend Micro, which played a major role in helping law enforcement take down Scan4You, has described it as the first widely available CAV service that criminals could use to test their malware against modern antivirus tools.  

The service allowed almost anyone to submit a malicious file and verify if antimalware tools would flag it as malicious. Malware authors used the service to scan millions of files, including keyloggers, remote access Trojans, crypters, and entire malware tool kits.

Unlike legitimate malware-scanning services, which share scanning results with the broader community, Scan4You provided the results of its scans only to the individual submitting the file. Bondars and Martisevs offered up to 100,000 scans per month for just $30, with acceptable forms of payment including PayPal, Bitcoin, and WebMoney. Trend Micro estimates that, at its peak, Scan4You earned its operators some $15,000 a month.

Prior to Scan4You's launch in 2009, such anonymous scanning services where only available privately within the most organized of criminal enterprises, says a security analyst at Trend Micro who did not wish to be identified.

Examples of groups that used such services privately include Rove Digital, an Estonian click-fraud gang, and the Mevade group from Israel and Ukraine. "Scan4You made such a service available to the masses — greatly increasing the effectiveness of their malware attacks," the security analyst says.

Over the years, other CAV providers, including resellers of Scan4You services, have popped up, but they haven't been quite as successful. The biggest remaining CAV service is VirusCheckMate, an operation that doesn't appear to have benefited a whole lot from Scan4You's takedown, says the Trend Micro analyst.

One reason could be the relative complexity and low payoffs from operating a CAV service. "To run a CAV service is quite technically challenging, as you need to maintain a separate virtual machine for each of the AV products that your service supports," the analyst says.

"So, if a CAV allowed scanning with 30 AV scanners, that is 30 different virtual machines to maintain." Each of those machines would need to be both constantly up to date with the latest malware definitions and also disabled from sending feedback to the vendors in question, the Trend Micro security analyst notes. CAV operators also need to create code for automating the malware submission process and for retrieving the results out of custom security software logs.

"Being operators of Scan4You was likely quite prestigious in cybercrime circles" for Bondars and Martisevs, which explains why they persisted with the operation for eight years, the analyst says. The pair also was involved with other malicious services and groups—most notably Eva Pharmacy, one of the oldest and largest pharmaceutical spam gangs—which likely also brought in money.

For the moment, it is unclear why cybercriminals that were using Scan4You have not yet migrated to other CAV services like VirusCheckMate. "But this is a welcome trend," the Trend Micro analyst says.

One big hope is that the Scan4You takedown has had a deterrent effect on cybercriminals and will force them to either maintain their own private CAV service or to release their malware without testing. "All of those outcomes drive up the cost of doing business for cybercriminal operators," the analyst says.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Empathy: The Next Killer App for Cybersecurity?
Shay Colson, CISSP, Senior Manager, CyberClarity360,  11/13/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15769
PUBLISHED: 2018-11-16
RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue. A malicious TLS server could potentially cause a Denial Of Service (DoS) on TLS clients during the handshake when a very large prime value is...
CVE-2018-18955
PUBLISHED: 2018-11-16
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resour...
CVE-2018-19311
PUBLISHED: 2018-11-16
Centreon 3.4.x allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
CVE-2018-19312
PUBLISHED: 2018-11-16
Centreon 3.4.x allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
CVE-2018-19318
PUBLISHED: 2018-11-16
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.