Bitdefender

Fighting cybercrime

In 2014, Bitdefender built an AI model that successfully blocked the WannaCry ransomware attack in 2017.[23]

Since 2016, Bitdefender has advised Europol’s European Cybercrime Centre (EC3) in supporting investigations into online criminal activity.[24] Bitdefender joined the No More Ransom initiative in 2016, releasing free decryption tools for victims of ransom attacks to decrypt their devices without having to pay to do so.[25][26] This included releasing a free universal decryption kit for users affected by the GandCrab ransomware attack in 2018.[27]

In 2016, Bitdefender advised the FBI, the DEA, and the Dutch National Police (with the support of Europol) during Operation Bayonet, culminating in the shutdown of the AlphaBay and Hansa black markets in 2017.[28]

In 2018, Bitdefender joined the Cybersecurity Tech Accord,[29] and in 2019, provided operational support to the European Cybercrime Centre, helping shut down the Sipulimarket and Silkktie darknet markets.[30]

Bitdefender's 2020 research into the Interplanetary Storm botnet proxy network was provided to law enforcement ahead of the FBI dismantling the network in November 2023.[31]

In September 2023, Bitdefender provided support to Finnish authorities contributing to the seizure of the PIILOPUOTI dark web marketplace.[32] In May 2024, Bitdefender was a supporting partner for Europol's Operation Endgame, which Europol called the largest operation ever against bots, including IcedID, SystemBC, Pikabot, Smokeloader and Bumblebee.[33] It led to the takedown of over 100 servers, and four arrests worldwide.[34][35] The next phase of Operation Endgame, which took place between November 10 and 13, 2025, led to 1,025 servers being taken down, disrupting credential theft, crypto wallet compromise, and other online attacks affecting hundreds of thousands of victims.[36]

Researchers for Bitdefender provided Finnish customs with information to help shut down the Sipulitie Tor marketplace in October 2024.[37]

Consumer

Bitdefender's consumer offerings include antivirus and malware protection services, as well as password management, identity threat protection, and VPN services.[38][39] Their all-in-one plans are available for Windows, Mac OS, iOS, and Android, and offered in tiers, including Bitdefender Ultimate Security, and specific plans for small businesses and content creators.Bitdefender's consumer services are managed through an online portal, called Bitdefender Central.[40]

The company also releases free decryption tools for victims of ransomware attacks, including the BitLocker-abusing ShrinkLocker ransomware in 2024.[41]

Enterprise

Bitdefender's endpoint security products are managed through the GravityZone platform.[42] The company also offers an extended detection and response (XDR) platform and additional security services.[43]

GravityZone expanded in 2025 to include PHASR (Proactive Hardening and Attack Surface Reduction), which allows for dynamic, individualized security configurations.[44]

Artificial intelligence

In May 2022, Bitdefender researchers made available over 25,000 AI agents trained on 60 Atari games to help other researchers with imitation and multi-task learning.[45]

In December 2023, Bitdefender launched Scamio, a free AI-powered scam detector,[46] which was integrated into WhatsApp in April 2024, and Discord in October 2024.[47][48]

In October 2024, the company announced it was consolidating its scam detection and AI prevention technologies into the Scam Copilot platform.[49][50]

Trojan.FakeAlert.5

On March 20, 2010, computers running Bitdefender under 64-bit versions of Windows were affected by a malfunctioning update that classified every executable program as well as DLL files as infected. These files were all marked as 'Trojan.FakeAlert.5' and were moved into quarantine. This action led to software and systems malfunctions that affected users globally.[51] Bitdefender representatives announced the removal of the faulty update and a workaround for the users affected,[52] except for those using the 2008 version.[53]

DarkSide ransomware

In 2020, hacker group DarkSide switched its main encryption ransomware product over to an "affiliate" model wherein other attackers could download and use its software in exchange for a portion of the profits. However, it introduced a bug in the process where affiliate hackers would all use the same private RSA key - meaning that a decryption package for a single target who paid the ransom would work on any target that had the ransomware installed. Security researchers noticed and were quietly already helping victims of the software, but with no public notice, making it so that the attackers would only see an inexplicable decrease in ransom payments that could be written off as chance.

Months later, Bitdefender publicly released a decryptor of its own development and issued a blog post describing the flaw. Security researchers studying the Colonial Pipeline cyberattack in May 2021 criticized Bitdefender for using the bug as a brief burst of publicity, though they acknowledged that DarkSide would’ve eventually noticed and fixed the issue.[54] Bitdefender defended its actions, saying it only wished to notify as many organizations as possible,[55] triggering a discussion among cybersecurity professionals about the pros and cons of publicly disclosing such vulnerabilities in malware:[56] while the provision of free decryption tools may[57] provide relief for some ransomware victims (who might otherwise not receive free and timely help from experts), their usefulness is short-lived as hackers use these same tools to improve and develop new ransomware software.[54]

Since the creation of its free Darkside Ransomware Decryption Tool, Bitdefender has continued to provide free decryption and recovery tools to the general public on 'multiple occasions', the latest being February 2023.