rodag   1

Infamous Hacker Heading Chinese Antivirus Firm?
What does a young Chinese hacker do once he’s achieved legendary status for developing Microsoft Office zero-day exploits and using them to hoover up piles of sensitive data from U.S. Defense Department contractors? Would you believe: Start an antivirus firm?

That appears to be what’s happened at Anvisoft, a Chinese antivirus startup that is being somewhat cagey about its origins and leadership. I stumbled across a discussion on the informative Malwarebytes user forum, in which forum regulars were scratching their heads over whether this was a legitimate antivirus vendor. Anvisoft had already been whitelisted by several other antivirus and security products (including Comodo), but the discussion thread on Malwarebytes about who was running this company was inconclusive, prompting me to dig deeper.

I turned to Anvisoft’s own user forum, and found that I wasn’t the only one hungry for answers. This guy asked a similar question back in April 2012, and was answered by an Anvisoft staff member named “Ivy,” who said Anvisoft was “a new company with no past records, and we located in Canada.” Follow-up questions to the Anvisoft forum admins about the names of company executives produced this response, again from Ivy:

“The person who runs anvisoft company is not worth mentioning because he is unknown to you.  Yes, the company is located at Canada. 5334 Yonge Street, Suite 141, Toronto, Ontario M2N 6V1, Canada.”

A quick review of the Web site registration records for indicated the company was located in Freemont, Calif. And a search on the company’s brand name turned up trademark registration records that put Anvisoft in the high-tech zone of Chengdu, a city in the Sichuan Province of China.

Urged on by these apparent inconsistencies, I decided to take a look back at the site’s original WHOIS records, using the historical WHOIS database maintained by For many months, the domain’s registration records were hidden behind paid WHOIS record privacy protection services. But in late November 2011 — just prior to Anvisoft’s official launch — that WHOIS privacy veil was briefly lowered, revealing this record:

wth rose
Moor Building ST Fremont. U.S.A
Fremont, California 94538
United States
Administrative Contact:
rose, wth
Moor Building ST Fremont. U.S.A
Fremont, California 94538
United States
(510) 783-9288
A few days later, the “wth rose” registrant name was replaced with “Anvisoft Technology,” and the address usurped by “” (emails to both addresses went unanswered). But this only made me more curious, so I had a look at the Web server where is hosted.

The current Internet address of is, and a reverse DNS lookup on this IP address tells me that there are at least three other domain names hosted at this address:,, and The latter forwards to a domain parking service and its WHOIS information is shielded.

But both and also were originally registered to wth rose and And their WHOIS records history went back even further, revealing a more fascinating detail: Prior to being updated with Anvisoft’s corporate information, they also were registered to a user named “tandailin” in Gaoxingu, China, with the email address

Image: iDefense

When I saw that record, I was instantly reminded of an infamous Chinese hacker who went by the name Wicked Rose (a.k.a. “Withered Rose“). In 2007, Verisign’s iDefense released a report (PDF) on Rose’s hacking exploits, which detailed his alleged role as the leader of a state-sponsored, four-man hacking team called NCPH (short for Network Crack Program Hacker).  According to iDefense, in 2006 the group was responsible for crafting a rootkit that took advantage of a zero-day vulnerability in Microsoft Word, and was used in attacks on “a large DoD entity” within the USA.

“Wicked Rose and the NCPH hacking group are implicated in multiple Office based attacks over a two year period,” the report stated.

iDefense analysts also include a section with pictures of Wicked Rose, explaining that Rose’s real name is Tan Dailin, and that he is a now-28-year-old who cut his teeth at the Sichuan University of Science and Engineering in Zigong, a city in the Sichuan Province of China.

The report said that at the time, Rose administered his hacking team’s Web site at, and ran his own personal blog at According to historic WHOIS records, the email address used to register was, the same email address in the historic WHOIS records for Anvisoft’s online properties.

Some more tantalizing clues: According to iDefense, one of Dailin’s buddies in NCPH — a hacker nicknamed “Rodag” — also ran his own blog. Rodag appears to still be blogging there, so I had Google Translate show me his latest postings: Turns out, earlier this year Rodag urged readers to download and install Anvisoft Smart Defender, calling it a “security aid from abroad” that offers “superior performance” and is “very simple and beautiful.”

Until recently, another site registered to — the now-defunct — featured on its home page a long review of Anvisoft, explaining to readers “why you need a good antivirus.”

This may all be a strange coincidence or hoax. Anvisoft may in fact be a legitimate company, with a legitimate product; and for all I know, it is. But until it starts to answer some basic questions about who’s running the company, this firm is going to have a tough time gaining any kind of credibility or market share.

Related Posts:Who’s Behind the TDSS Botnet?Financial Mogul Linked to DDoS Attacks‘Booter Shells’ Turn Web Sites into WeaponsHow Not to Buy Tax SoftwareHarvesting Data on the Xarvester Botmaster
A_Little_Sunshine  Latest_Warnings  anvisoft  Anvisoft_Smart_Defender  domaintools  idefense  Malwarebytes  NCPH  Network_Crack_Program_Hacker  Rodag  Tan_Dailin  Verisign  Wicked_Rose  Withered_Rose  wth_rose  from google
november 2012 by mpjohnsn

related tags  a_little_sunshine  anvisoft  anvisoft_smart_defender  domaintools  idefense  latest_warnings  malwarebytes  ncph  network_crack_program_hacker  tan_dailin  verisign  wicked_rose  withered_rose  wth_rose 

Copy this bookmark: