Top counter antivirus service disrupted in global takedown | CyberScoop<\/title> <meta name=\"description\" content=\"AVCheck and related crypting services helped cybercriminals make malware difficult to detect and confirm that malware could slip through various antivirus tools undetected, officials said.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/avcheck-global-takedown\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Top counter antivirus service disrupted in global takedown\"> <meta property=\"og:description\" content=\"AVCheck and related crypting services helped cybercriminals make malware difficult to detect and confirm that malware could slip through various antivirus tools undetected, officials said.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/avcheck-global-takedown\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-05-30T22:25:12+00:00\"> <meta property=\"article:modified_time\" content=\"2025-05-30T22:25:15+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png\"> <meta property=\"og:image:width\" content=\"1396\"> <meta property=\"og:image:height\" content=\"816\"> <meta property=\"og:image:type\" content=\"image\/png\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1746040294g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1748529128g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1748220166g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/84719\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=84719\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Favcheck-global-takedown%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Favcheck-global-takedown%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-84719 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/avcheck-global-takedown\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.9180327868852\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.971428571429\">\n<div class=\"single-article__header-content\" readability=\"35.314350797267\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/avcheck-global-takedown\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> AVCheck and related crypting services helped cybercriminals make malware difficult to detect and confirm that malware could slip through various antivirus tools undetected, officials said. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/84719\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"374\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown.png?resize=640%2C374&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"AVCheck site for counter antivirus service displays a seizure notice on May 29, 2025.\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png 1396w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png?resize=300,175 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png?resize=768,449 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png?resize=1024,599 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png?resize=600,351 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png?resize=287,168 287w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png?resize=577,337 577w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown-1.png?resize=1155,675 1155w\" sizes=\"(max-width: 1155px) 100vw, 1155px\"><figcaption> AVCheck site for counter antivirus service displays a seizure notice on May 29, 2025. <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"31.105397422127\"><body readability=\"63.882149591452\"><\/p>\n<p>AVCheck, a large-scale service that cybercriminals use to check if their malware can be detected by various antivirus tools, was <a href=\"https:\/\/www.justice.gov\/usao-sdtx\/pr\/websites-selling-hacking-tools-cybercriminals-seized\">seized and taken offline<\/a> Tuesday by a globally coordinated law enforcement action.<\/p>\n<p>Officials on Thursday said they seized four domains and a server associated with the online software crypting syndicate. The <a href=\"https:\/\/avcheck.net\/\">site for the counter antivirus service<\/a> and its related crypting services \u2014 <a href=\"http:\/\/cryptor.biz\/\">Cryptor.biz<\/a> and <a href=\"http:\/\/crypt.guru\/\">Crypt.guru<\/a> \u2014 now display seizure notices with logos for the Justice Department, FBI, the Secret Service, the Dutch national police and the Finnish police.<\/p>\n<p>\u201cAs cybercriminals have become more sophisticated in their schemes, they have likewise become more advanced in their efforts to avoid detection,\u201d Nicholas J. Ganjei, U.S. Attorney for the Southern District of Texas, said in a statement. \u201cAs such, our law enforcement efforts must involve striking not just at the individual fraudster or hacker, but the enablers of these cybercriminals as well. This investigation did exactly that. With this syndicate shut down, there is one less provider of malicious tools for cybercriminals out there.\u201d<\/p>\n<p>Dutch authorities described AVCheck as <a href=\"https:\/\/www.politie.nl\/en\/news\/2025\/may\/30\/key-service-for-malware-developers-taken-offline.html\">one of the largest counter antivirus services<\/a> used by cybercriminals globally, noting that it allowed attackers to access and deploy malware to victim networks undetected. Officials said the related crypting services enabled cybercriminals to make malware difficult for antivirus programs to detect.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cTaking AVCheck offline is an important step in the fight against organised cybercrime, because it disrupts the activities of cybercriminals in the earliest stages and prevents victims,\u201d Matthijs Jaspers, team lead of the Dutch national police High Tech Crime unit, said in a statement. <\/p>\n<p>Before initiating the takedown, authorities said they made undercover purchases from the seized sites and confirmed they were designed for cybercrime. Prosecutors allege some email addresses and other data linked to the services are used by ransomware groups that have targeted victims in Houston, other parts of the United States and globally. <\/p>\n<p>\u201cCybercriminals don\u2019t just create malware; they perfect it for maximum destruction,\u201d Douglas Williams, Special Agent in Charge of FBI Houston, said in a statement. \u201cBy leveraging counter antivirus services, malicious actors refine their weapons against the world\u2019s toughest security systems to better slip past firewalls, evade forensic analysis, and wreak havoc across victims\u2019 systems.\u201d<\/p>\n<p>The successful law enforcement action against AVCheck and its related services was conducted as part of <a href=\"https:\/\/www.operation-endgame.com\/\">Operation Endgame<\/a>, an ongoing globally coordinated effort to disrupt cybercrime. The AVCheck takedown marks the fourth high-profile law enforcement action against malware operations in the past week. <\/p>\n<p>Global law enforcement authorities and cybersecurity companies previously <a href=\"https:\/\/cyberscoop.com\/lumma-stealer-infostealer-takedown\/\">toppled the prolific Lumma Stealer infostealer operation<\/a>, which <a href=\"https:\/\/cyberscoop.com\/lumma-infostealer-widespread-victims\/\">infected about 10 million systems<\/a>. Officials also seized and disrupted <a href=\"https:\/\/cyberscoop.com\/danabot-malware-botnet-seizure-takedown\/\">DanaBot\u2019s malware-as-a-service operations<\/a>, and <a href=\"https:\/\/cyberscoop.com\/operation-endgame-ransomware-infrastructure-takedown-europol\/\">dismantled hundreds of domains and servers<\/a> used across several leading malware strains.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.318853974122\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/05\/top-counter-antivirus-service-disrupted-in-global-takedown.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/avcheck-global-takedown\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Top counter antivirus service disrupted in global takedown | CyberScoop<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4365,4366,282,78,338,273,669,117,1913,168,46,1422],"tags":[4367,4368,286,86,341,279,671,119,1916,169,54,1423],"class_list":["post-7697","post","type-post","status-publish","format-standard","hentry","category-antivirus","category-counter-antivirus","category-cybercrime","category-cybersecurity","category-department-of-justice-doj","category-fbi","category-federal-bureau-of-investigation-fbi","category-government","category-justice-department","category-malware","category-ransomware","category-secret-service","tag-antivirus","tag-counter-antivirus","tag-cybercrime","tag-cybersecurity","tag-department-of-justice-doj","tag-fbi","tag-federal-bureau-of-investigation-fbi","tag-government","tag-justice-department","tag-malware","tag-ransomware","tag-secret-service"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/antivirus\/\" rel=\"category tag\">antivirus<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/counter-antivirus\/\" rel=\"category tag\">counter antivirus<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-justice-doj\/\" rel=\"category tag\">Department of Justice (DOJ)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/fbi\/\" rel=\"category tag\">FBI<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government\/\" rel=\"category tag\">Government<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/justice-department\/\" rel=\"category tag\">Justice Department<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/malware\/\" rel=\"category tag\">Malware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/secret-service\/\" rel=\"category tag\">Secret Service<\/a>","tag_info":"Secret Service","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7697"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7697\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7697,"date":"2025-05-30T17:25:12","date_gmt":"2025-05-30T22:25:12","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=84719"},"modified":"2025-05-30T17:25:12","modified_gmt":"2025-05-30T22:25:12","slug":"top-counter-antivirus-service-disrupted-in-global-takedown","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/05\/30\/top-counter-antivirus-service-disrupted-in-global-takedown\/","title":{"rendered":"Top counter antivirus service disrupted in global takedown"},"content":{"rendered":"