Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/1/2019
01:40 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Cybercriminals Using Popular TV Shows to Spread Malware

Illegally streamed episodes of Game of Thrones, The Walking Dead, and Arrow used by cybercriminals to deploy malicious files.

Woburn, MA – April 1, 2019 – New research from Kaspersky Lab has found that cybercriminals are actively using episodes of popular television shows to distribute malware to fans. “Game of Thrones,” “The Walking Dead” and “Arrow” are the shows most frequently used by attackers as a disguise for malicious files.

Television shows are a universal form of entertainment, and with the rise of online streaming, torrents and other methods of digital distribution, viewers are now able to access TV shows without having to tune in live. In many regions, popular programs are also consumed via illegal channels, such as torrent-trackers and unauthorized streaming platforms. Unlike legitimate resources, torrent trackers and hosted files may prompt a user to download a file that looks like an episode of a TV show, but is in fact malware with a similar name.

Seeing how easily TV shows downloaded from illegitimate resources can be replaced with malware-carrying versions, Kaspersky Lab researchers took a closer look at such compromised files from both 2017 and 2018. In both years, “Game of Thrones” led the list of TV shows targeted by cybercriminals to use as a disguise for malware. In 2018, the show accounted for 17 percent of all infected pirated content, with 20,934 attacked users.

This is despite the fact that in 2018, there were no new episodes of “Game of Thrones” released, while the other top shows in the rankings were promoted with high profile marketing campaigns. “The Walking Dead” was the next most popular show, with 18,794 users attacked, followed by “Arrow,” with 12,163.

In every case observed, the malware distributors focused on targeting the first and the last episode of each season, with the launch episode the most actively used. For example, the “Game of Thrones” Season 1 episode “The Winter is Coming” was the most commonly targeted episode of the show.

“We can see clearly that malware distributors exploit TV shows that are in high demand on pirated websites; these are usually actively promoted dramas or action series,” said Anton V. Ivanov, security researcher at Kaspersky Lab. “The first and final episodes, attracting the most viewers, are likely to be at greatest risk of malicious spoofing. Online fraudsters tend to exploit people’s loyalty and impatience, so may promise brand new material for download that is in fact a cyberthreat. Keeping in mind that the final season of ‘Game of Thrones’ starts this month, we would like to warn users that it is highly likely there will be a spike in the amount of malware disguised as new episodes of this show.”

To avoid falling victim to malicious files posing as TV show downloads, Kaspersky Lab recommends the following security tips for viewers:

  • Only use legitimate services with a proven reputation for producing and distributing TV content to view and download shows.
  • When downloading files, pay attention to the file extension. Even if you download TV show episodes from a source you consider trusted and legitimate, the file should have an .avi, .mkv or mp4 extension. Do not download the file if it is an .exe.
  • Pay extra attention to a website’s authenticity before streaming or downloading any shows. Confirm that a website is genuine by double- checking the format of the URL or the spelling of the company name before starting any downloads, and ensure the link starts with HTTPS://.
  • Do not click on suspicious links, such as those promising an early view of a new episode; check the TV-show schedule and keep track of it.
  • Use reliable security solution for comprehensive protection from a wide range of threats, such as Kaspersky Security Cloud.

The full text of Kaspersky Lab’s report, “Game of Threats: How Cybercriminals Use Popular TV Shows to Spread Malware,” is available on Securelist.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
How to Think Like a Hacker
Dr. Giovanni Vigna, Chief Technology Officer at Lastline,  10/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17223
PUBLISHED: 2019-10-15
There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.
CVE-2019-17593
PUBLISHED: 2019-10-14
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
CVE-2019-17594
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-17595
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-14823
PUBLISHED: 2019-10-14
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to...