Major Takedown of Cybercrime Syndicate: Global Law Enforcement Action

On May 27, 2025, a significant operation by multinational law enforcement successfully dismantled an online cybercrime syndicate that provided crucial services to cybercriminals. This operation, led by the U.S. Department of Justice (DoJ) in collaboration with Dutch and Finnish authorities, resulted in the seizure of four domains associated with a crypting service designed to help malware evade detection by security software.

Details of the Operation

The seized domains include AvCheck[.]net, Cryptor[.]biz, and Crypt[.]guru. These sites, now displaying seizure notices, were integral in facilitating services that allowed malicious actors to mask their software from antivirus programs. In addition to the U.S., other countries, including France, Germany, Denmark, Portugal, and Ukraine, played active roles in the operation.

According to the DoJ, "Crypting" refers to a technique where software is used to obscure malware, making it difficult for antivirus programs to identify. The domains offered various services, including counter-antivirus (CAV) tools, which, together with crypting services, allowed cybercriminals to hide their malware effectively. This obfuscation enables unauthorized access to computer systems, heightening the threat to users worldwide.

Undercover Investigations

To ensure the effectiveness of this operation, law enforcement agents conducted undercover purchases to analyze the services being offered on these platforms. Dutch authorities identified AvCheck as one of the most extensive CAV services utilized by cybercriminals globally.

Internet Archive snapshots of AvCheck[.]net reveal that the site marketed itself as a "high-speed antivirus scantime checker," allowing registered users to scan files against 26 different antivirus engines and scrutinize domains and IP addresses with 22 antivirus systems and blocklists.

Part of a Larger Initiative

This seizure is part of Operation Endgame, a broader initiative launched in 2024 aimed at disrupting cybercrime on a global scale. It is the fourth significant action taken recently, following the takedowns of the Lumma Stealer, DanaBot, and numerous domains linked to ransomware distribution.

Douglas Williams, the FBI Houston Special Agent in Charge, commented on the operation, stating, "Cybercriminals don’t just create malware; they perfect it for maximum destruction." He emphasized that by leveraging counter-antivirus services, these individuals refine their tools to evade the most sophisticated security systems, increasing their ability to cause damage and chaos.

Emergence of New Threats

The recent developments in the cybercrime landscape include the introduction of PureCrypter, a malware-as-a-service (MaaS) solution that disseminates information-stealing software like Lumma and Rhadamanthys. Promoted on online forums such as Hackforums[.]net by a user named PureCoder, the service is offered at various price points: $159 for three months, $399 for one year, and $799 for lifetime access. It is further propagated through an automated Telegram channel called @ThePureBot, which doubles as a marketplace for other malicious tools.

What sets PureCrypter apart is its capability to patch the NtManageHotPatch API in memory on Windows machines running version 24H2 or later, enabling processes that facilitate code injection. This underscores the agility of threat actors in adapting to evolving security measures.

Evasion Techniques and Market Manipulation

According to cybersecurity firm eSentire, PureCrypter employs multiple evasion techniques, including AMSI bypass, DLL unhooking, and anti-VM detection, among others. Notably, it can overcome security features integrated into Windows 11 24H2 through sophisticated API patching.

The developers also engage in misleading marketing tactics, promoting claims of being "Fully UnDetected" (FUD) based on results from services like AvCheck[.]net. However, cross-referencing with VirusTotal reveals that many antivirus and endpoint detection solutions do detect these threats, highlighting the discrepancies in their advertised capabilities.

Conclusion

The recent takedown of these cybercrime domains emphasizes the ongoing battle between law enforcement and cybercriminals. As malicious actors continually evolve their tactics, the commitment of global authorities to combat and dismantle these networks remains crucial. The landscape of cybercrime is complex and ever-changing, underscoring the need for vigilance and advanced protective measures in cybersecurity.