Loading story…
Dutch authorities arrested a 33-year-old Dutch man suspected of operating AVCheck, a major “counter-antivirus” service used by cybercriminals to test malware against multiple antivirus engines and tune payloads to evade detection. The suspect was detained at Schiphol Airport in Amsterdam after an international surveillance effort; investigators seized data storage devices and are also examining the role of two companies allegedly tied to enabling access to the platform.
AVCheck was previously taken down as part of Operation Endgame, a multinational disruption effort coordinated by authorities in the Netherlands, the United States, and Finland. Prosecutors said the suspect deregistered in the Netherlands and reportedly fled to the United Arab Emirates around the time of the platform’s takedown, and that intelligence gathered during the earlier operation contributed to identifying and investigating him.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Dutch authorities publicly announced the arrest of the suspected AVCheck operator and said the case was built in part using intelligence obtained from the 2025 takedown. Officials alleged the suspect and two associated companies enabled cybercriminals and malware developers to use the platform.
Dutch authorities arrested a 33-year-old Dutch man suspected of being behind AVCheck on Sunday evening at Schiphol Airport in Amsterdam after an international surveillance operation. Officials also seized the suspect's data storage devices.
Around the time AVCheck was dismantled, the suspected operator reportedly deregistered in the Netherlands and fled to the United Arab Emirates. Prosecutors cited this movement as part of the case timeline tied to the service's shutdown.
AVCheck, a major counter-antivirus service used by cybercriminals to test malware against antivirus products, was taken down during the second wave of Operation Endgame in a coordinated action by authorities in the Netherlands, the United States, and Finland. Investigators later said intelligence gathered from this disruption helped identify the suspected operator.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law enforcement operation disrupted the **Imminent Monitor** remote access trojan (RAT), a malware tool marketed online as legitimate remote administration software but widely used for cybercrime. Researchers at Palo Alto Networks Unit 42 said they collected more than **65,000** samples and observed over **115,000** attacks tied to the malware, which included stealth and persistence features, antivirus-evasion tooling, hidden keylogging, and later cryptocurrency-mining capability. Investigators linked the malware’s developer, known as **"Shockwave™"**, to Australia and referred the case to the Australian Federal Police, which worked with partners including the FBI and Canada’s CRTC to support **Operation Cepheus** and disable the RAT’s licensing infrastructure. The takedown exposed purchaser records and triggered enforcement against suspected users, with authorities reporting **85 warrants**, **434 device seizures**, and **13 arrests**. In the UK, that investigation led to the conviction of **Scott Cowley** of St Helens, Merseyside, who was sentenced to two years in prison after forensic analysis found he had used Imminent Monitor to hijack the webcams of three women and secretly record them in their bedrooms. The case underscored how a commodity RAT sold to thousands of customers was used not only for intrusion and surveillance, but also for sexual abuse and other criminal activity.
Aug 15, 2026
Dutch financial crime investigators arrested two IT entrepreneurs and seized more than 800 servers, laptops, phones, and business records in raids targeting hosting infrastructure allegedly used for **cyberattacks, interference operations, and disinformation campaigns** linked to Russia. The suspects, identified in reporting as Andrey Nesterenko and Youssef Zinad, are accused of violating EU sanctions by providing economic resources to sanctioned entities. Authorities said the operation began on 18 May and included searches in Enschede and Almere and data centers in Dronten and Schiphol-Rijk. The investigation focuses on **Stark Industries**, a hosting provider sanctioned by the EU in 2025, and on Dutch-linked firms including **WorkTitans B.V.**, **`THE.Hosting`**, and **MIRhosting**, which investigators believe helped keep sanctioned infrastructure online after restrictions took effect. Multiple reports tied the network to infrastructure used by the pro-Russian group **NoName057(16)** and the **Doppelgänger** disinformation operation, while Dutch and European reporting also linked related services to attacks on Danish government bodies during municipal elections. MIRhosting denied knowingly supporting illegal activity and said it cooperated with authorities, but customers of related brands reported widespread outages and loss of access after the seizures.
Jun 29, 2026
Dutch police arrested a **21-year-old man from Dordrecht** suspected of selling access to **JokerOTP**, a phishing automation tool used to intercept **one-time passwords (OTPs)** and bypass multi-factor authentication. Authorities said the suspect marketed the service via **Telegram** and was found in possession of **license keys** used to provide other criminals access to the bot. JokerOTP is described as a phishing-as-a-service capability that can **automatically call victims**, impersonate legitimate security alerts, and trick targets into entering OTPs; reporting also indicates it could be configured to capture additional sensitive data such as **PINs, payment card data, and social security numbers**, and target users of services including **PayPal, Venmo, Coinbase, Amazon, and Apple**. The arrest is the **third** tied to the JokerOTP operation, following the earlier arrests of the alleged developer (April 2025) and a co-developer (August 2025); UK law enforcement previously assessed the tool was used **28,000+ times across 13 countries** and linked to **at least $10 million** in losses.
Jun 29, 2026