Attacks/Breaches

4/1/2019
01:40 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Cybercriminals Using Popular TV Shows to Spread Malware

Illegally streamed episodes of Game of Thrones, The Walking Dead, and Arrow used by cybercriminals to deploy malicious files.

Woburn, MA – April 1, 2019 – New research from Kaspersky Lab has found that cybercriminals are actively using episodes of popular television shows to distribute malware to fans. “Game of Thrones,” “The Walking Dead” and “Arrow” are the shows most frequently used by attackers as a disguise for malicious files.

Television shows are a universal form of entertainment, and with the rise of online streaming, torrents and other methods of digital distribution, viewers are now able to access TV shows without having to tune in live. In many regions, popular programs are also consumed via illegal channels, such as torrent-trackers and unauthorized streaming platforms. Unlike legitimate resources, torrent trackers and hosted files may prompt a user to download a file that looks like an episode of a TV show, but is in fact malware with a similar name.

Seeing how easily TV shows downloaded from illegitimate resources can be replaced with malware-carrying versions, Kaspersky Lab researchers took a closer look at such compromised files from both 2017 and 2018. In both years, “Game of Thrones” led the list of TV shows targeted by cybercriminals to use as a disguise for malware. In 2018, the show accounted for 17 percent of all infected pirated content, with 20,934 attacked users.

This is despite the fact that in 2018, there were no new episodes of “Game of Thrones” released, while the other top shows in the rankings were promoted with high profile marketing campaigns. “The Walking Dead” was the next most popular show, with 18,794 users attacked, followed by “Arrow,” with 12,163.

In every case observed, the malware distributors focused on targeting the first and the last episode of each season, with the launch episode the most actively used. For example, the “Game of Thrones” Season 1 episode “The Winter is Coming” was the most commonly targeted episode of the show.

“We can see clearly that malware distributors exploit TV shows that are in high demand on pirated websites; these are usually actively promoted dramas or action series,” said Anton V. Ivanov, security researcher at Kaspersky Lab. “The first and final episodes, attracting the most viewers, are likely to be at greatest risk of malicious spoofing. Online fraudsters tend to exploit people’s loyalty and impatience, so may promise brand new material for download that is in fact a cyberthreat. Keeping in mind that the final season of ‘Game of Thrones’ starts this month, we would like to warn users that it is highly likely there will be a spike in the amount of malware disguised as new episodes of this show.”

To avoid falling victim to malicious files posing as TV show downloads, Kaspersky Lab recommends the following security tips for viewers:

  • Only use legitimate services with a proven reputation for producing and distributing TV content to view and download shows.
  • When downloading files, pay attention to the file extension. Even if you download TV show episodes from a source you consider trusted and legitimate, the file should have an .avi, .mkv or mp4 extension. Do not download the file if it is an .exe.
  • Pay extra attention to a website’s authenticity before streaming or downloading any shows. Confirm that a website is genuine by double- checking the format of the URL or the spelling of the company name before starting any downloads, and ensure the link starts with HTTPS://.
  • Do not click on suspicious links, such as those promising an early view of a new episode; check the TV-show schedule and keep track of it.
  • Use reliable security solution for comprehensive protection from a wide range of threats, such as Kaspersky Security Cloud.

The full text of Kaspersky Lab’s report, “Game of Threats: How Cybercriminals Use Popular TV Shows to Spread Malware,” is available on Securelist.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11515
PUBLISHED: 2019-04-25
core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.
CVE-2019-11511
PUBLISHED: 2019-04-25
Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
CVE-2019-11513
PUBLISHED: 2019-04-25
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
CVE-2019-11514
PUBLISHED: 2019-04-25
User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.
CVE-2019-11506
PUBLISHED: 2019-04-24
In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to Expo...