US and Europe shut down malware testing services linked to Ryuk

An international special operation by law enforcement agencies in the United States, the Netherlands, and Finland led to the shutdown of four popular websites that hackers used to test malware for “resistance” to antiviruses

On May 27, the official shutdown of the domains AVCheck.net, Crypt.guru, Cryptor.live, and Cryptor.biz took place, which cybercriminals had been using for decades to “crypt” — to test their own viruses for detection by antivirus programs. These resources played a key role in improving malware to such a level that it became invisible to protection systems. Investigators conducted fake purchases, established ties to groups such as Ryuk, and documented the platforms’ participation in more than 37 other investigations in the United States. The cost of the services ranged from 15 $ to 1,000 $, depending on the number of checks.

The closure of AVCheck and Cryptor platforms was a significant blow to the criminal infrastructure that allowed hackers to develop their attacks with impunity. Thanks to international cooperation between the US, the Netherlands and Finland, it was possible not only to block the services, but also to obtain valuable digital evidence for future arrests and investigations.