Popcorn Time ransomware operates a 'referrals program'

[Macman]

I take it they are caught via dodgy emails? Or visiting dodgy sites?

[Dashers]

Define dodgy site.

Advertising is a common attack vector. Commercial web-site operators tend to use advertising but don't want the effort of vetting each advert themselves, so they outsource that and display whatever.

Cross-site scripting flaws is another popular one.

Of course, it needs to be executed on the client computer, but there are sometimes exploits in browsers, sometimes people run what they think is innocent from a web-site they "trust".

[Saracen]

This is where a good backup strategy comes in handy.

That's my approach. Not because of ransomware, but it handles it.

Part of it is to keep 'static' files on write-once media. So, audio files, unchanging PDFs, my photo library, etc, are all "backed up", but then also "archived" onto long-term media.

Then, I identify rapidly changing important data, like accounts data files, emails, etc, and keep multiple copies in a proper backup system.

Then there's stuff I'm not really bothered about losing, which is backed up but nowhere near so comprehensively.


The key, IMHO, is a careful understanding of what data you have, what it means to you, what it's worth, and designing both your storage system and backup procedures to suit.

For some people, backups don't matter. For others, including me, losing some data might mean breaching contracts with clients or, much worse, failing to keep information I might need for VAT or personal/business tax purposes, and dropping myself in it with HMCE. Needless to say, that data is comprehensively and regularly backed up to systems sitting on an airgapped network. In fact, a fair bit of it only exists on that airgapped network, and backups thereof.


If I got hit, I'd :-

- format infected systems
- restore OS image
- restore data
- resume normal life.

[Waswat]

Popcorn time used to be a pretty good app for (illegally) streaming movies via torrents and such. Guess they took that name after it got taken down...

[Flibb]

It got taken down, but it's well and truly back up again.

Sent from my SM-G925F using Tapatalk