Pirates beware: Illegally downloaded TV shows — especially Game of Thrones — actively used to spread malware

SINGAPORE — Fans of popular television series Game of Thrones (GoT) may want to think twice before illegally downloading the show's upcoming final season. 

A study by cybersecurity firm Kaspersky Lab has shown that cybercriminals are actively using pirated content to spread malware, and GoT files are the most at risk.

Even though the numbers of users attacked by infected pirated files are declining, the firm said the trend should still give pause: “By dividing the number of users by the number of files we found that every TV show malware file has infected an average of 2.23 users in 2018.”

Last year, GoT accounted for 17 per cent of all infected pirated content, with 20,934 attacked users worldwide — even though HBO did not release any new episodes of the hit series in 2018.

This was followed by The Walking Dead which accounted for 15 per cent of all infected pirated files, and Arrow with 10 per cent.

“While the way we consume TV content is rapidly changing, the content itself remains in high demand, and users resort to any means available to get at it — including illegal and non-ethical ones like the use of pirated stuff,” Kaspersky Lab noted in its report on the study.

And despite moves by governments around the world to put a stop to the creation and distribution of pirated content, the firm noted that illegal downloads are still on the rise.

According to the latest Annual Piracy Report by Muso, a technology company that analyses online piracy, there were more than 300 billion visits to pirate websites in 2017, up 1.6 per cent from the year before.

Muso has ranked Singapore ninth in the world for internet piracy. On average, each Singaporean user visited piracy sites 180 times in 2016.

And torrents — a type of data file typically used to distribute pirated content — also prove to be a popular way of distributing malicious code, Kaspersky Lab said, even though numbers are decreasing.

“Online fraudsters tend to exploit people’s loyalty and impatience, so may promise brand new material for download that is in fact a cyberthreat,” Kaspersky Lab said.

Cybercriminals rely on torrent websites and hosted files to send users files that look like show episodes, but are in fact malware with a similar name.

• Last year, 126,340 users globally encountered TV-show-related malware, 33 per cent fewer than in 2017.

• The number of attacks by such malware has also decreased 22 per cent to 451,636 registered attempts.

The declines “might be connected to some of this year’s events potentially affecting the number of torrent file downloads”, Kaspersky Lab said.

First, in 2018, Google downranked more than 65,000 torrent websites – major distributors of pirated TV shows – leaving great many users unable to find them when looking for TV series downloads, the firm noted. (When Google downranks a site, it will not show up much lower in Google search results.)

Increasing numbers of torrent websites are also being blocked or shut down, Kaspersky Lab said.

“Two major torrent trackers (Pirate Bay and Demonoid) have of late suffered functionality collapses, and one of the world’s longest-standing ones, Leechers Paradise, was shut down for good.”

Torrents for Game of Thrones episodes were the most infected.

• GoT accounted for 17 per cent of all infected pirated content, with 20,934 attacked users worldwide

• The first and the last episodes of each Game of Thrones season were the most dangerous, accounting for the greatest number of malicious files in Kaspersky Lab’s collection and affecting the most users.

• The very first episode of the show was the one most actively used by cybercriminals.

• With GoT’s final season coming up, Kaspersky Lab warned that “it is highly likely there will be a spike in the amount of malware disguised as new episodes of the show.”

The Trojan malware was the most common threat, Kaspersky Lab said, accounting for about one-third of all threats. This is a dangerous type of malware able to cause much harm, from information theft to gaining control of the infected system.