Threat Intel
Russia Shifts from Torrenting to Streaming: Implications for SecOps
Russian users are moving away from torrent sites toward online streaming for pirated content, creating new malware and phishing vectors. Defenders must update threat intel, block malicious domains, and monitor traffic for abnormal streaming patterns.
What Happened
Russian users have largely abandoned torrent sites in favor of online streaming services for pirated films and TV series.
Who Is Affected
Internet users, ISPs, and content‑delivery networks in Russia, as well as global CDN providers hosting illicit streams.
Impact on Defenders
Increased traffic to malicious streaming domains, higher risk of malware distribution, and new attack vectors via compromised streaming platforms.
Mitigation Steps
- Update threat‑intelligence feeds to include known illicit streaming domains.
- Deploy DNS filtering and web‑filtering solutions to block access to these sites.
- Monitor outbound traffic for unusual streaming patterns and anomalous DNS queries.
- Educate users about the risks of untrusted streaming sites.
Resources
Leverage threat‑intel services that track streaming‑related malware and phishing campaigns.
Related articles
Star Blizzard Shifts to RedFlick Phishing, Deploys CosmicPulse Backdoor
Star Blizzard, a Russia‑linked APT group, has moved from ClickFix to a new phishing technique called RedFlick, enabling delivery of the CosmicPulse backdoor with reduced user interaction. The change targets Ukrainian‑linked NGOs, think tanks, and journalists, increasing compromise likelihood and evasion of detection. Defenders should update email filters, deploy EDR signatures, and monitor for CosmicPulse indicators.
Read briefing
NAPLISTENER: SIESTAGRAPH Threat Shifts to Persistent Access via Windows Service
Elastic Security Labs identified NAPLISTENER, a new C# HTTP listener installed as Wmdtc.exe, as part of the SIESTAGRAPH threat group’s pivot from data exfiltration to persistent foothold. The malware masquerades as Msdtc.exe, evades network detection, and alters IIS response headers to hide its presence. Defenders should audit services, inspect IIS logs for anomalous Server headers, and block the Wmdtc.exe process.
Read briefing
Streaming Royalty Fraud: $10M Bot Scheme Sentences Musician to 18 Months
A North Carolina musician was sentenced to 18 months after orchestrating a $10M streaming fraud using AI‑generated tracks and a bot network. The scheme involved over 1,000 bot accounts, VPNs, and cloud services to inflate streams on major platforms. Defenders should monitor anomalous streaming patterns, enforce rate limits, and detect VPN usage to mitigate similar attacks.
Read briefing
Ransomware Landscape Shifts: Q2 2026 Report Highlights Growing Competition and AI‑Accelerated Ops
Check Point Research’s Q2 2026 ransomware report shows the ecosystem is still dominated by a handful of RaaS groups, but the tail is widening: 93 active actors now versus 71 in Q1, with the top 10 accounting for 57.6 % of victims (down from 71 %). Victim numbers stayed flat quarter‑on‑quarter, yet the US share dropped to 42 % as new groups like The Gentlemen and Krybit target fewer American targets. The Gentlemen’s internal leak revealed an AI‑powered ransomware‑management panel built in three days, marking the first hard evidence that generative‑AI is speeding up malicious tool development. P
Read briefing