Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/1/2019
01:40 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Cybercriminals Using Popular TV Shows to Spread Malware

Illegally streamed episodes of Game of Thrones, The Walking Dead, and Arrow used by cybercriminals to deploy malicious files.

Woburn, MA – April 1, 2019 – New research from Kaspersky Lab has found that cybercriminals are actively using episodes of popular television shows to distribute malware to fans. “Game of Thrones,” “The Walking Dead” and “Arrow” are the shows most frequently used by attackers as a disguise for malicious files.

Television shows are a universal form of entertainment, and with the rise of online streaming, torrents and other methods of digital distribution, viewers are now able to access TV shows without having to tune in live. In many regions, popular programs are also consumed via illegal channels, such as torrent-trackers and unauthorized streaming platforms. Unlike legitimate resources, torrent trackers and hosted files may prompt a user to download a file that looks like an episode of a TV show, but is in fact malware with a similar name.

Seeing how easily TV shows downloaded from illegitimate resources can be replaced with malware-carrying versions, Kaspersky Lab researchers took a closer look at such compromised files from both 2017 and 2018. In both years, “Game of Thrones” led the list of TV shows targeted by cybercriminals to use as a disguise for malware. In 2018, the show accounted for 17 percent of all infected pirated content, with 20,934 attacked users.

This is despite the fact that in 2018, there were no new episodes of “Game of Thrones” released, while the other top shows in the rankings were promoted with high profile marketing campaigns. “The Walking Dead” was the next most popular show, with 18,794 users attacked, followed by “Arrow,” with 12,163.

In every case observed, the malware distributors focused on targeting the first and the last episode of each season, with the launch episode the most actively used. For example, the “Game of Thrones” Season 1 episode “The Winter is Coming” was the most commonly targeted episode of the show.

“We can see clearly that malware distributors exploit TV shows that are in high demand on pirated websites; these are usually actively promoted dramas or action series,” said Anton V. Ivanov, security researcher at Kaspersky Lab. “The first and final episodes, attracting the most viewers, are likely to be at greatest risk of malicious spoofing. Online fraudsters tend to exploit people’s loyalty and impatience, so may promise brand new material for download that is in fact a cyberthreat. Keeping in mind that the final season of ‘Game of Thrones’ starts this month, we would like to warn users that it is highly likely there will be a spike in the amount of malware disguised as new episodes of this show.”

To avoid falling victim to malicious files posing as TV show downloads, Kaspersky Lab recommends the following security tips for viewers:

  • Only use legitimate services with a proven reputation for producing and distributing TV content to view and download shows.
  • When downloading files, pay attention to the file extension. Even if you download TV show episodes from a source you consider trusted and legitimate, the file should have an .avi, .mkv or mp4 extension. Do not download the file if it is an .exe.
  • Pay extra attention to a website’s authenticity before streaming or downloading any shows. Confirm that a website is genuine by double- checking the format of the URL or the spelling of the company name before starting any downloads, and ensure the link starts with HTTPS://.
  • Do not click on suspicious links, such as those promising an early view of a new episode; check the TV-show schedule and keep track of it.
  • Use reliable security solution for comprehensive protection from a wide range of threats, such as Kaspersky Security Cloud.

The full text of Kaspersky Lab’s report, “Game of Threats: How Cybercriminals Use Popular TV Shows to Spread Malware,” is available on Securelist.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13640
PUBLISHED: 2019-07-17
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
CVE-2019-5222
PUBLISHED: 2019-07-17
There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216(C00E214R2P1). The Secure Input does not properly limit certain system privilege. An attacker tricks the user to install a malicious application and successful ...
CVE-2019-1919
PUBLISHED: 2019-07-17
A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to the VM console to log in to the device with a static account that has root privileges. The vulnerability is due to the presence of an account w...
CVE-2019-1920
PUBLISHED: 2019-07-17
A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected interface. The vulnerability is due to a lack of complete error handling conditi...
CVE-2019-1923
PUBLISHED: 2019-07-17
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by access...