Federal Jury Convicts Operator of Massive Counter-Antivirus Service

A federal jury in Virginia has convicted Latvian resident Ruslans Bondars on charges related to his operation of Scan4You, one of the largest counter-antivirus (CAV) services in the cyber underground before it was shut down in 2016.

After a five-day trial, the jury found Bondars guilty of felony hacking, wire fraud, and other charges connected with operating the service, which offered threat actors a way to check if their malware was detectable by antivirus tools. At least 30,000 people used the illegitimate service to vet their malware before distribution during the period Scan4You was operational, between 2009 and 2016.

Among the many criminal hackers that used Scan4You to test and improve their malware was the group behind the Target breach that exposed data on more than 40 million credit cards in addition to nearly 70 million email addresses. Another threat actor used Scan4You to assist in the development of the widely distributed Citadel Trojan, which infected more than 11 million computers worldwide and resulted in some $500 million in fraud losses, the US Department of Justice said in a statement.

Russian national Jurijs Martisevs, an individual who assisted Bondars in operating Scan4You, pleaded guilty to his role in March and is awaiting sentencing. Both men were arrested last year in Latvia and extradited to the US amid protests by Russia that Martisevs' arrest was actually a kidnapping.

"At its height, Scan4You was one of the largest services of its kind and had at least thousands of users," the DOJ said in its statement this week. "Malware developed with the assistance of Scan4You included some of the most prolific malware known to the FBI and was used in major computer intrusions committed against American businesses."

Security vendor Trend Micro, which played a major role in helping law enforcement take down Scan4You, has described it as the first widely available CAV service that criminals could use to test their malware against modern antivirus tools.  

The service allowed almost anyone to submit a malicious file and verify if antimalware tools would flag it as malicious. Malware authors used the service to scan millions of files, including keyloggers, remote access Trojans, crypters, and entire malware tool kits.

Unlike legitimate malware-scanning services, which share scanning results with the broader community, Scan4You provided the results of its scans only to the individual submitting the file. Bondars and Martisevs offered up to 100,000 scans per month for just $30, with acceptable forms of payment including PayPal, Bitcoin, and WebMoney. Trend Micro estimates that, at its peak, Scan4You earned its operators some $15,000 a month.

Prior to Scan4You's launch in 2009, such anonymous scanning services where only available privately within the most organized of criminal enterprises, says a security analyst at Trend Micro who did not wish to be identified.

Examples of groups that used such services privately include Rove Digital, an Estonian click-fraud gang, and the Mevade group from Israel and Ukraine. "Scan4You made such a service available to the masses — greatly increasing the effectiveness of their malware attacks," the security analyst says.

Over the years, other CAV providers, including resellers of Scan4You services, have popped up, but they haven't been quite as successful. The biggest remaining CAV service is VirusCheckMate, an operation that doesn't appear to have benefited a whole lot from Scan4You's takedown, says the Trend Micro analyst.

One reason could be the relative complexity and low payoffs from operating a CAV service. "To run a CAV service is quite technically challenging, as you need to maintain a separate virtual machine for each of the AV products that your service supports," the analyst says.

"So, if a CAV allowed scanning with 30 AV scanners, that is 30 different virtual machines to maintain." Each of those machines would need to be both constantly up to date with the latest malware definitions and also disabled from sending feedback to the vendors in question, the Trend Micro security analyst notes. CAV operators also need to create code for automating the malware submission process and for retrieving the results out of custom security software logs.

"Being operators of Scan4You was likely quite prestigious in cybercrime circles" for Bondars and Martisevs, which explains why they persisted with the operation for eight years, the analyst says. The pair also was involved with other malicious services and groups—most notably Eva Pharmacy, one of the oldest and largest pharmaceutical spam gangs—which likely also brought in money.

For the moment, it is unclear why cybercriminals that were using Scan4You have not yet migrated to other CAV services like VirusCheckMate. "But this is a welcome trend," the Trend Micro analyst says.

One big hope is that the Scan4You takedown has had a deterrent effect on cybercriminals and will force them to either maintain their own private CAV service or to release their malware without testing. "All of those outcomes drive up the cost of doing business for cybercriminal operators," the analyst says.

Related Content: