Trump Signals He May Influence Netflix–Warner Bros Merger Decision 
Samsung Faces Major Strike Threat as Union Restarts Pay Talks 
Samsung Shares Surge After Strike Deal Eases Labor Tensions 
Paramount Skydance Eyes Streamlined Merger with Warner Bros Discovery Amid $60 Billion Offer Rejection 
6 simple questions to tell if a ‘finfluencer’ is more flash than cash 
Jazz Ensemble Cancels Kennedy Center New Year’s Eve Shows After Trump Renaming Sparks Backlash 
Intuit Raises Full-Year Forecast After Strong Q3 Earnings Despite Stock Drop 
Trump–Kushner Links Raise Concerns as Paramount Pushes $108B Warner Bros Discovery Bid 
Tencent Shares Jump 4% as AI Models Move Toward Paid Commercial Services 
TSMC Stake Sale Sends Vanguard Semiconductor Shares Lower 
PDG Explores $1 Billion Sale of China Data Center Assets 
How Marvel’s Fantastic Four discovered the human in the superhuman 
Blackstone and Google Launch AI Cloud Venture, Pressuring CoreWeave and Nebius Shares 
Paramount’s $108.4B Hostile Bid for Warner Bros Discovery Signals Major Shift in Hollywood 
SpaceX IPO Nears as Goldman Sachs Set to Lead Historic $75 Billion Offering 
Korean drama shows have garnered immense popularity even in regions outside South Korea. Local and international fans often resort to downloading media copies through torrent and pirate sites.
This method is illicit and highly discouraged. Also, the lack of knowledge on digital security measures could also lead to becoming a victim of malicious campaigns done through torrent sites.
Malware targeting Korean users spreads through torrent sites
A malicious campaign was confirmed in a recent report by WeLiveSecurity based on data coming from the ESET antivirus software. It has detected hundreds of devices infected with the same malware acquired from downloading K-drama files and video games through torrent sites. Compromised devices are composed of 80 percent from South Korea, 10 percent from China, and 5 percent from Taiwan.
Security researchers named the malware in this breach as GoBotKR. It was identified as a modified version of the GoBot2 and designed to avoid detection in the South Korean territories specifically. GoBotKR has reportedly been active since March 2018.
How GoBotKR is spread among Korean torrent users
GoBotKR is being spread on torrent sites by mixing an actual K-drama media file with the malicious contents. Torrent downloads typically came in a folder containing an MP4 file along with an executable LNK file posing as a shortcut to the media content, so both have identical file names.
Malicious torrent downloads also contained an archived PMA file with bogus codec installers. Torrent users who are not familiar with LNK’s executable properties could be easily tricked into clicking it instead of the actual MP4 file. This is how the GoBotKR is secretly installed on computers.
Clicking only the media content should not result in any issue. However, the LNK is a shortcut that will also open the MP4 video, so unsuspecting victims will not be immediately alarmed that they just installed malware on their device. Once the malware has successfully been installed, compromised devices are being added to a network of bots remotely controlled by the attackers.
Without the torrent user knowing, their computer can be used on massive DDoS attacks. Developers also observed the attackers had been secretly collecting data sent to command and control (C&C) servers — all based in South Korea. Types of information gathered include network configuration and main computer specs.
