Attacks/Breaches

4/1/2019
01:40 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Cybercriminals Using Popular TV Shows to Spread Malware

Illegally streamed episodes of Game of Thrones, The Walking Dead, and Arrow used by cybercriminals to deploy malicious files.

Woburn, MA – April 1, 2019 – New research from Kaspersky Lab has found that cybercriminals are actively using episodes of popular television shows to distribute malware to fans. “Game of Thrones,” “The Walking Dead” and “Arrow” are the shows most frequently used by attackers as a disguise for malicious files.

Television shows are a universal form of entertainment, and with the rise of online streaming, torrents and other methods of digital distribution, viewers are now able to access TV shows without having to tune in live. In many regions, popular programs are also consumed via illegal channels, such as torrent-trackers and unauthorized streaming platforms. Unlike legitimate resources, torrent trackers and hosted files may prompt a user to download a file that looks like an episode of a TV show, but is in fact malware with a similar name.

Seeing how easily TV shows downloaded from illegitimate resources can be replaced with malware-carrying versions, Kaspersky Lab researchers took a closer look at such compromised files from both 2017 and 2018. In both years, “Game of Thrones” led the list of TV shows targeted by cybercriminals to use as a disguise for malware. In 2018, the show accounted for 17 percent of all infected pirated content, with 20,934 attacked users.

This is despite the fact that in 2018, there were no new episodes of “Game of Thrones” released, while the other top shows in the rankings were promoted with high profile marketing campaigns. “The Walking Dead” was the next most popular show, with 18,794 users attacked, followed by “Arrow,” with 12,163.

In every case observed, the malware distributors focused on targeting the first and the last episode of each season, with the launch episode the most actively used. For example, the “Game of Thrones” Season 1 episode “The Winter is Coming” was the most commonly targeted episode of the show.

“We can see clearly that malware distributors exploit TV shows that are in high demand on pirated websites; these are usually actively promoted dramas or action series,” said Anton V. Ivanov, security researcher at Kaspersky Lab. “The first and final episodes, attracting the most viewers, are likely to be at greatest risk of malicious spoofing. Online fraudsters tend to exploit people’s loyalty and impatience, so may promise brand new material for download that is in fact a cyberthreat. Keeping in mind that the final season of ‘Game of Thrones’ starts this month, we would like to warn users that it is highly likely there will be a spike in the amount of malware disguised as new episodes of this show.”

To avoid falling victim to malicious files posing as TV show downloads, Kaspersky Lab recommends the following security tips for viewers:

  • Only use legitimate services with a proven reputation for producing and distributing TV content to view and download shows.
  • When downloading files, pay attention to the file extension. Even if you download TV show episodes from a source you consider trusted and legitimate, the file should have an .avi, .mkv or mp4 extension. Do not download the file if it is an .exe.
  • Pay extra attention to a website’s authenticity before streaming or downloading any shows. Confirm that a website is genuine by double- checking the format of the URL or the spelling of the company name before starting any downloads, and ensure the link starts with HTTPS://.
  • Do not click on suspicious links, such as those promising an early view of a new episode; check the TV-show schedule and keep track of it.
  • Use reliable security solution for comprehensive protection from a wide range of threats, such as Kaspersky Security Cloud.

The full text of Kaspersky Lab’s report, “Game of Threats: How Cybercriminals Use Popular TV Shows to Spread Malware,” is available on Securelist.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7303
PUBLISHED: 2019-04-23
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 b...
CVE-2019-7304
PUBLISHED: 2019-04-23
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
CVE-2019-0223
PUBLISHED: 2019-04-23
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1...
CVE-2017-12619
PUBLISHED: 2019-04-23
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".
CVE-2018-1317
PUBLISHED: 2019-04-23
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.