Attacks/Breaches
1/30/2017
02:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Netflix Scam Spreads Ransomware

A program found on suspicious websites aims to trick Windows/PC users into creating fake Netflix logins so it can deliver ransomware.

A newly discovered threat aims to steal Netflix user credentials and hold them hostage, according to researchers at Trend Micro.

Netflix has 93 million subscribers in more than 190 countries. It's a popular app, but many people aren't willing to pay the monthly subscription fee. They'll try to bypass the cost and watch content for free - and cybercriminals are now taking advantage of them.

This newly detected ransomware, RANSOM_NETIX.A, aims to trick Windows PC users with a login generator typically used for software and account membership piracy. This type of program is found on malicious websites promising access to paid Web-based services.

How does it work? Victims click a "Generate Login" button to kick-start the encryption process. The ransomware uses fake login prompts as a distraction while it encrypts 39 file types under the C:\Users directory.

The program then demands $100 in Bitcoin from victims. While it targets Windows users, it's worth noting the ransomware destroys itself on systems not running Windows 7 or Windows 10.

Netflix, with its massive user base, presents a tempting opportunity for hackers to exploit vulnerabilities, infect systems to steal user data, and monetize data on the dark Web. Stolen credentials can be used to bargain among criminals or trick victims into installing malware, which can generate profit.

"We regularly see threat actors utilize popular apps or services as a lure to get victims to infect themselves," explains Jon Clay, global director of threat communications at Trend Micro. "Also, by using imagery that is similar to the real vendor's imagery, [criminals] trick the victim into thinking it's real."

Clay says this discovery marks a continuation of 2016 ransomware trends, which included the creation of new tactics to generate more victims. After seeing nearly 750% growth in new ransomware families in 2016, Trend Micro predicted 25% growth in new families for 2017.

The Netflix scam carries implications for how ransomware will evolve later in the year.

"We will likely see other popular vendors targeted with their brands, especially if the actors behind [the Netflix scam] find success," he continues. "They will use this tactic again with other vendors."

This is a wake-up call for potential victims to protect their accounts. Best practices include regularly updating account credentials, employing two-factor authentication, limiting downloads to official sources, and being wary of illegitimate emails.

Businesses should educate their employees on how ransomware threats work, and how using legitimate brands in social engineering attacks can trick victims into making dangerous decisions. Employees should be aware that trying to obtain a free Netflix account is "bogus," says Clay, and should not be acted upon.

Social engineering is core to this type of scam, and users can protect themselves by avoiding downloads from sketchy websites or clicking suspicious ads. If a deal seems too good to be true, it typically is.

Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance & Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.