Popcorn TimeMalware
Last reported today, by The Hacker News2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
- T1542.003Bootkit
“APT41 revives BlackLotus bootkit: Chinese cyber espionage group APT42 has been using new versions of the BlackLotus bootkit , named BlackX, which they have used to target entities all over Central Asia.”
- T1543.003Windows Service
“…d Eye's update to VirusTotal, and antivirus engines started flagging it as malware, a fair description of a program that disables a Windows service.”
- T1552.004Private Keys
“Browser makers untrusted its root after it used weak private keys to generate eight intermediary certificates.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet“Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“Security firm uninstalls defunct Popcorn Time clone from 2m PCs: Dutch security firm Eye Security has uninstalled an abandoned and vulnerable Popcorn Time piracy app from more than two million Windows and macOS PCs.”
Indicators in its reports
named in the reports above- railway[.]comin 1 report
- pylos[.]coin 1 report
- infosec[.]exchangein 1 report
- masto.deoan[.]orgin 1 report
- sheogorath.bsky[.]socialin 1 report
- chaos[.]socialin 1 report
- hack[.]luin 1 report
- 6.2.1[.]18in 1 report
- 6.2.1[.]17in 1 report
- 3.5.0[.]173in 1 report
- popcorntimeupd[.]xyzin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.